search

autoai-org / AID

One-Stop System for Machine Learning.
https://aid.autoai.org/
Apache License 2.0
320 stars 34 forks source link

urllib3-1.25.10-py2.py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.5) #1965

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago
Vulnerable Library - urllib3-1.25.10-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/9f/f0/a391d1463ebb1b233795cabfc0ef38d3db4442339de68f847026199e69d7/urllib3-1.25.10-py2.py3-none-any.whl

Path to dependency file: /components/mlserve

Path to vulnerable library: /components/mlserve,/components/mlserve/requirements.txt

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (urllib3 version) Remediation Available
CVE-2021-33503 High 7.5 urllib3-1.25.10-py2.py3-none-any.whl Direct 1.26.5 ❌

Details

CVE-2021-33503 ### Vulnerable Library - urllib3-1.25.10-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/9f/f0/a391d1463ebb1b233795cabfc0ef38d3db4442339de68f847026199e69d7/urllib3-1.25.10-py2.py3-none-any.whl

Path to dependency file: /components/mlserve

Path to vulnerable library: /components/mlserve,/components/mlserve/requirements.txt

Dependency Hierarchy: - :x: **urllib3-1.25.10-py2.py3-none-any.whl** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Publish Date: 2021-06-29

URL: CVE-2021-33503

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/urllib3/urllib3/security/advisories/GHSA-q2q7-5pp4-w6pg

Release Date: 2021-06-29

Fix Resolution: 1.26.5

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.