CVE-2022-31471

Advisory

Untangle 1.2.1 includes a fix for CVE-2022-31471: Untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files. See CVE-2022-31471.


MISC:https://github.com/stchris/untangle: https://github.com/stchris/untangle
MISC:https://github.com/stchris/untangle/releases/tag/1.2.1: https://github.com/stchris/untangle/releases/tag/1.2.1
MISC:https://jvn.jp/en/jp/JVN30454777/: https://jvn.jp/en/jp/JVN30454777/

Resources

• https://github.com/stchris/untangle
• https://github.com/stchris/untangle/releases/tag/1.2.1
• https://jvn.jp/en/jp/JVN30454777/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31471