untangle vulnerable to XML Entity Expansion
Date: 2022-08
Affected: pip/untangle
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2022-31471
CVE-2022-33977
CWE: CWE-611
CWE-776
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

### Impact An attacker may be able to cause a denial-of-service (DoS) condition on the server on which the product is running. This affects untangle versions up to and including 1.2.0 ### Patches The problem has been fixed with version 1.2.1 ### Workarounds None ### References https://jvn.jp/en/jp/JVN30454777/ ### For more information If you have any questions or comments about this advisory: * Open an [issue](https://github.com/stchris/untangle/issues)


Mitigations:

Architectural layers (MAESTRO):