En bref
- CVE-2022-33977 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant untangle, untangle (untangle project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.8%, plus élevée que 78.7% des vulnérabilités.
- Correctif : mettre à jour vers 1.2.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| untangle PyPI | < 1.2.1
| 1.2.1
|
| untangle | ≤ 1.2.0
| No fix yet |
Description
Impact
An attacker may be able to cause a denial-of-service (DoS) condition on the server on which the product is running. This affects untangle versions up to and including 1.2.0
Patches
The problem has been fixed with version 1.2.1
Workarounds
None
References
https://jvn.jp/en/jp/JVN30454777/
For more information
If you have any questions or comments about this advisory:
NVD description
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free