JVN#30454777
Multiple vulnerabilities in untangle

Overview

untangle provided by Christian Stefanescu contains multiple vulnerabilities.

Products Affected

• untangle 1.2.0 and earlier

Description

untangle provided by Christian Stefanescu is a Python library for processing XML documents. untangle contains multiple vulnerabilities listed below.

• Improper Restriction of Recursive Entity References in DTDs (CWE-776) - CVE-2022-33977

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L	Base Score: 4.3
  CVSS v2	AV:N/AC:L/Au:N/C:N/I:N/A:P	Base Score: 5.0

• Improper Restriction of XML External Entity Reference (CWE-611) - CVE-2022-31471

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	Base Score: 4.3
  CVSS v2	AV:N/AC:L/Au:N/C:P/I:N/A:N	Base Score: 5.0

Impact

• An attacker may be able to cause a denial-of-service (DoS) condition on the server on which the product is running - CVE-2022-33977
• An attacker may be able to read the contents of local files - CVE-2022-31471

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.