CVE-2022-33977

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-776

Affected software

Vendor	Product	Versions
Christian Stefanescu	untangle	1.2.0 and earlier

References

https://github.com/stchris/untangleProduct, Third Party Advisory
https://github.com/stchris/untangle/releases/tag/1.2.1Release Notes, Third Party Advisory
https://jvn.jp/en/jp/JVN30454777/Third Party Advisory
https://github.com/stchris/untangleProduct, Third Party Advisory
https://github.com/stchris/untangle/releases/tag/1.2.1Release Notes, Third Party Advisory
https://jvn.jp/en/jp/JVN30454777/Third Party Advisory

Timeline

Published: Jul 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-339786.1Reflected Cross-Site Scripting (XSS) vulnerability FontMeister plugin <= 1.08 at WordPress.CVE-2022-33989.8OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.CVE-2022-339809.8Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard for CVE-2022-339813.3drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw CVE-2022-339826.4DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on the SMI handler and le CVE-2022-339837.0DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption through CVE-2022-339847.0DMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM corruption through a TO CVE-2022-339857.0DMA transactions which are targeted at input buffers used for the NvmExpressDxe software SMI handler could cause SMRAM corruption through a CVE-2022-339866.4DMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could lead to a TOCTOU attack. DMA attacks on the pa CVE-2022-339875.3The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.CVE-2022-339887.5dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send quer CVE-2022-339895.3dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolv