GHSA-f83q-2cp7-qrjg

Suggest an improvement
Source
https://github.com/advisories/GHSA-f83q-2cp7-qrjg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-f83q-2cp7-qrjg/GHSA-f83q-2cp7-qrjg.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-f83q-2cp7-qrjg
Aliases
Published
2022-08-06T05:30:13Z
Modified
2024-11-18T23:40:36.338563Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
untangle vulnerable to Improper Restriction of XML External Entity Reference
Details

Description

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.

Impact

An attacker may be able to read the contents of local files. This affects untangle versions up to and including 1.2.0

Patches

The problem has been fixed with version 1.2.1

Workarounds

None

References

https://jvn.jp/en/jp/JVN30454777/

For more information

If you have any questions or comments about this advisory: * Open an issue

Database specific
{
    "nvd_published_at": "2022-07-26T06:15:00Z",
    "cwe_ids": [
        "CWE-611"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-06T05:30:13Z"
}
References

Affected packages

PyPI / untangle

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.1

Affected versions

0.*

0.3
0.3.1
0.4.0

1.*

1.0.0
1.1.0
1.1.1
1.2.0