CVE-2022-33977 untangle vulnerable to XML Entity Expansion
A remote attacker can cause a denial-of-service condition in applications using the untangle Python library by exploiting improper restriction of recursive entity references in XML DTDs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-33977?
CVE-2022-33977 is a high-severity vulnerability in Christian Stefanescu untangle, published on 26 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.
Weakness: CWE-776
Which versions are affected by CVE-2022-33977?
3 open source packages ship an affected version, including untangle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
untangle PyPI | All versions | 1.2.1 |
untangle PyPI | All versions | 1.2.1 |
untangle PyPI | All versions | 1.2.1 |
Products include Untangle Project Untangle.
How do I fix CVE-2022-33977?
Upgrade untangle to 1.2.1 or later.
Is CVE-2022-33977 being exploited?
There is no known exploitation of CVE-2022-33977 in the wild and no public exploit code.
Other vulnerabilities in Christian Stefanescu untangle
Sources
Also known as DEBIAN-CVE-2022-33977, GHSA-7xr3-6ggc-wc9p, PYSEC-2022-243.