Vulnerability · Published Jul 26, 2022 · Assigned by jpcert
CVE-2022-33977
High 7.5
In plain English
A high-severity security flaw in untangle from Christian Stefanescu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.8%top 21.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-untangle | 1.2.1-1 | DEBIAN-CVE-2022-33977 |
| Debian:13 | python-untangle | 1.2.1-1 | DEBIAN-CVE-2022-33977 |
| Debian:14 | python-untangle | 1.2.1-1 | DEBIAN-CVE-2022-33977 |
| PyPI | untangle | 1.2.1 | GHSA-7xr3-6ggc-wc9p |
| PyPI | untangle | 1.2.1 | PYSEC-2022-243 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Christian Stefanescu | untangle | 1.2.0 and earlier |
References
- https://github.com/stchris/untangle x_refsource_MISC
- https://github.com/stchris/untangle/releases/tag/1.2.1 x_refsource_MISC
- https://jvn.jp/en/jp/JVN30454777/ x_refsource_MISC