Bug 861353 (CVE-2022-31471, CVE-2022-33977)

Summary:	<dev-python/untangle-1.2.1: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	mgorny, python, sci
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/stchris/untangle/releases/tag/1.2.1
Whiteboard:	B3 [noglsa]
Package list:		Runtime testing required:	---
Bug Depends on:	861416
Bug Blocks:

Description John Helmert III archtester

2022-07-27 06:00:54 UTC

CVE-2022-31471 (https://jvn.jp/en/jp/JVN30454777/):

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.

CVE-2022-33977 (https://jvn.jp/en/jp/JVN30454777/):

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.

Please report security bugs when security issues are in changelogs!

Please stable when ready.

Comment 1 Michał Górny archtester

2022-07-27 09:05:08 UTC

cleanup done

Comment 2 John Helmert III archtester

2022-07-27 15:14:55 UTC

Thanks, all done!