Vulnerability · Published Jul 26, 2022 · Assigned by jpcert
CVE-2022-31471
High 7.5
In plain English
A high-severity security flaw in untangle from Christian Stefanescu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.7%top 22.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-untangle | 1.2.1-1 | DEBIAN-CVE-2022-31471 |
| Debian:13 | python-untangle | 1.2.1-1 | DEBIAN-CVE-2022-31471 |
| Debian:14 | python-untangle | 1.2.1-1 | DEBIAN-CVE-2022-31471 |
| PyPI | untangle | 1.2.1 | GHSA-f83q-2cp7-qrjg |
| PyPI | untangle | 1.2.1 | PYSEC-2022-244 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Christian Stefanescu | untangle | 1.2.0 and earlier |
References
- https://github.com/stchris/untangle x_refsource_MISC
- https://github.com/stchris/untangle/releases/tag/1.2.1 x_refsource_MISC
- https://jvn.jp/en/jp/JVN30454777/ x_refsource_MISC