Security: xml.etree.ElementTree used across 10 core modules — no XXE protection

[DataWizual]

During a security audit of pan-os-python, two findings were identified.

---

Finding 1: Unsafe XML parser (High)

xml.etree.ElementTree is used across 10 core modules with no defusedxml
replacement or defuse_stdlib() call anywhere in the codebase.

Affected modules:
base.py, firewall.py, network.py, panorama.py, policies.py,
objects.py, ha.py, plugins.py, userid.py, __init__.py

The library's purpose is parsing XML responses from live network devices.
Any attacker-influenced response (MitM, compromised appliance, rogue endpoint)
is processed without XXE or Billion Laughs protection.

Fix: replace import xml.etree.ElementTree as ET with
import defusedxml.ElementTree as ET in each affected module.
Drop-in compatible, no API changes required.

---

Finding 2: SHA-1 used for value hashing (Medium)

panos/base.py:3172 uses hashlib.sha1() with an inline comment
explicitly documenting the usage. SHA-1 has been cryptographically
broken since 2017.

[ngfw-automation]

defusedxml is not recommended anymore

[DataWizual]

Thanks for the reference. You're right that defusedxml is no longer recommended — Python docs were updated after expat 2.6.0 (February 2024) addressed the core vulnerabilities, and Python 3.11–3.15 ship with expat 2.7.1 which is not vulnerable.
The concern stands for environments running Python < 3.11 or using a system-provided expat older than 2.6.0, which is still common in enterprise and embedded deployments. If pan-os-python officially requires Python 3.11+, this finding is effectively mitigated. If the minimum supported version is lower, the exposure remains for those users.
What's the minimum Python version this library supports?