Headline
GHSA-7xr3-6ggc-wc9p: untangle before 1.2.1 vulnerable to XML Entity Expansion
Impact
An attacker may be able to cause a denial-of-service (DoS) condition on the server on which the product is running. This affects untangle versions up to and including 1.2.0
Patches
The problem has been fixed with version 1.2.1
Workarounds
None
References
https://jvn.jp/en/jp/JVN30454777/
For more information
If you have any questions or comments about this advisory:
- Open an issue
untangle before 1.2.1 vulnerable to XML Entity Expansion
High severity GitHub Reviewed Published Aug 6, 2022 in stchris/untangle • Updated Aug 6, 2022
Related news
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.