JVN#30454777: Multiple vulnerabilities in untangle

untangle provided by Christian Stefanescu is a Python library for processing XML documents. untangle contains multiple vulnerabilities listed below.

Improper Restriction of Recursive Entity References in DTDs (CWE-776) - CVE-2022-33977

Improper Restriction of XML External Entity Reference (CWE-611) - CVE-2022-31471

Impact

• An attacker may be able to cause a denial-of-service (DoS) condition on the server on which the product is running - CVE-2022-33977
• An attacker may be able to read the contents of local files - CVE-2022-31471

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.

Products Affected

• untangle 1.2.0 and earlier