In breve
- CVE-2022-33977 è una vulnerabilità ALTO (CVSS 7.5) che riguarda untangle, untangle (untangle project).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.8%, superiore al 78.7% delle vulnerabilità.
- Correzione: aggiornare a 1.2.1 o successiva.
| Package | Affected versions | Patched versions |
|---|
| untangle PyPI | < 1.2.1
| 1.2.1
|
| untangle | ≤ 1.2.0
| No fix yet |
Description
Impact
An attacker may be able to cause a denial-of-service (DoS) condition on the server on which the product is running. This affects untangle versions up to and including 1.2.0
Patches
The problem has been fixed with version 1.2.1
Workarounds
None
References
https://jvn.jp/en/jp/JVN30454777/
For more information
If you have any questions or comments about this advisory:
NVD description
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free