CVE-2013-1665

Advisory

Symphony-bdk-python 1.2.0 starts using the more secure defusedxml library to avoid XML vulnerabilities.
https://github.com/finos/symphony-bdk-python/commit/114c9abb763cb883d6cdb471cfca38afc32f1adc

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Beta release for the Python BDK 2.0

New features
180: Retry mechanism
187: Message class to ease the sending of a complex message

Bug fixes
184: Asyncio usage with proxy on Windows
185 191: Fixes of security issues
190: Removed legacy folder (as code in master branch)
189: Made bot username and app id mandatory in configuration

Documentation
181: Documented Slash commands
182: Documented how to solve self-signed certificate issues
183: Documented UserJoinedRoomActivity

Installation

$ pip install sym-api-client-python==2.0b3

Resources

• https://pypi.org/project/symphony-bdk-python
• https://pyup.io/changelogs/symphony-bdk-python/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1665