search

DEV-REPO-URIEL / WSD-2772

0 stars 0 forks source link

starlette-0.12.7.tar.gz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed #10

Closed dev-mend-for-github-com[bot] closed 8 months ago

dev-mend-for-github-com[bot] commented 8 months ago
Vulnerable Library - starlette-0.12.7.tar.gz

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/e1/ac/e6295213366717f6fe80b4c177d406e3a19357d7b66d7b297a18644bc97a/starlette-0.12.7.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: d445b5ff678ee057c010cfbfad2f93c3e3c391b1

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (starlette version) Fix PR available
WS-2020-0300 High 7.5 starlette-0.12.7.tar.gz Direct 0.37.1 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2020-0300 ### Vulnerable Library - starlette-0.12.7.tar.gz

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/e1/ac/e6295213366717f6fe80b4c177d406e3a19357d7b66d7b297a18644bc97a/starlette-0.12.7.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - :x: **starlette-0.12.7.tar.gz** (Vulnerable Library)

Found in HEAD commit: d445b5ff678ee057c010cfbfad2f93c3e3c391b1

Found in base branch: main

### Vulnerability Details

Path Traversal vulnerability was found in starlette before 0.13.5. The vulnerability allows a remote attacker to perform directory traversal attacks. The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Publish Date: 2020-06-23

URL: WS-2020-0300

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-06-23

Fix Resolution (starlette): starlette - 0.13.5

Direct dependency fix Resolution (starlette): 0.37.1

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

dev-mend-for-github-com[bot] commented 8 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.