search

DEV-REPO-URIEL / WSD-2772

0 stars 0 forks source link

starlette-0.12.0.tar.gz: 1 vulnerabilities (highest severity is: 7.5) #16

Open dev-mend-for-github-com[bot] opened 7 months ago

dev-mend-for-github-com[bot] commented 7 months ago
Vulnerable Library - starlette-0.12.0.tar.gz

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/c1/cc/f44e628329935573cea19d74c49b1480a6df8f5b4ebeb3c321a48e075222/starlette-0.12.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: d445b5ff678ee057c010cfbfad2f93c3e3c391b1

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (starlette version) Remediation Possible**
WS-2020-0300 High 7.5 starlette-0.12.0.tar.gz Direct 0.13.5 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2020-0300 ### Vulnerable Library - starlette-0.12.0.tar.gz

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/c1/cc/f44e628329935573cea19d74c49b1480a6df8f5b4ebeb3c321a48e075222/starlette-0.12.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - :x: **starlette-0.12.0.tar.gz** (Vulnerable Library)

Found in HEAD commit: d445b5ff678ee057c010cfbfad2f93c3e3c391b1

Found in base branch: main

### Vulnerability Details

Path Traversal vulnerability was found in starlette before 0.13.5. The vulnerability allows a remote attacker to perform directory traversal attacks. The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Publish Date: 2020-06-23

URL: WS-2020-0300

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-06-23

Fix Resolution: 0.13.5

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.