GitHub Advisoryadvisory · PyPI
GHSA-7xr3-6ggc-wc9p untangle vulnerable to XML Entity Expansion
HIGH
Official page ↗
- Aliases
- CVE-2022-33977
- Ecosystem
- PyPI
- Packages
- untangle
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-776
- Reviewed
- 2022-08-06
Affected packages
• PyPI untangle: < 1.2.1 → fixed in 1.2.1
Description
Impact
An attacker may be able to cause a denial-of-service (DoS) condition on the server on which the product is running. This affects untangle versions up to and including 1.2.0
Patches
The problem has been fixed with version 1.2.1
Workarounds
None
References
https://jvn.jp/en/jp/JVN30454777/
For more information
If you have any questions or comments about this advisory:
• Open an issue
Related
Alias · CVE (1)
- CVE-2022-33977 untangle is a python library to convert XML data to python objects. vulnerability
Weakness · CWE (1)
- CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness
References
- https://github.com/stchris/untangle/security/advisories/GHSA-7xr3-6ggc-wc9p web
- https://nvd.nist.gov/vuln/detail/CVE-2022-33977 advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/untangle/PYSEC-2022-243.yaml web
- https://github.com/stchris/untangle package
- https://github.com/stchris/untangle/releases/tag/1.2.1 web
- https://jvn.jp/en/jp/JVN30454777 web