mend-for-github-com[bot]
commented
3 weeks ago :heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
CVE-2024-49767 - Medium Severity Vulnerability
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/f6/f8/9da63c1617ae2a1dec2fbf6412f3a0cfe9d4ce029eccbda6e1e4258ca45f/Werkzeug-2.2.3-py3-none-any.whl
Path to dependency file: /contrib/EdgeXfoundry/app/requirements.txt
Path to vulnerable library: /contrib/EdgeXfoundry/app/requirements.txt
Dependency Hierarchy: - Flask-1.1.2-py2.py3-none-any.whl (Root Library) - :x: **Werkzeug-2.2.3-py3-none-any.whl** (Vulnerable Library)
Found in HEAD commit: dd01a1d4381c7a3b94ba25748c015a094c33088e
Found in base branch: master
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
Publish Date: 2024-10-25
URL: CVE-2024-49767
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2
Release Date: 2024-10-25
Fix Resolution: quart - 0.19.7;werkzeug - 3.0.6