Path to dependency file: /jupyter-scipy/requirements.txt
Path to vulnerable library: /jupyter-scipy/requirements.txt,/jupyter-pytorch-full/requirements.txt,/jupyter-scipy/requirements.txt,/jupyter-tensorflow-full/requirements.txt,/jupyter-pytorch-full/requirements.txt,/jupyter-tensorflow-full/requirements.txt
starlette before 0.27.0 is vulnerable to Path Traversal. When using StaticFiles, if there's a file or directory that starts with the same name as the StaticFiles directory, that file or directory is als. which vulnerability.
WS-2023-0138 - Low Severity Vulnerability
The little ASGI library that shines.
Library home page: https://files.pythonhosted.org/packages/12/48/f9c1ec6bee313aba264fbc2483d9070f4e4526f2538e2b55b1e4a391d938/starlette-0.26.1-py3-none-any.whl
Path to dependency file: /jupyter-scipy/requirements.txt
Path to vulnerable library: /jupyter-scipy/requirements.txt,/jupyter-pytorch-full/requirements.txt,/jupyter-scipy/requirements.txt,/jupyter-tensorflow-full/requirements.txt,/jupyter-pytorch-full/requirements.txt,/jupyter-tensorflow-full/requirements.txt
Dependency Hierarchy: - :x: **starlette-0.26.1-py3-none-any.whl** (Vulnerable Library)
Found in base branch: master
starlette before 0.27.0 is vulnerable to Path Traversal. When using StaticFiles, if there's a file or directory that starts with the same name as the StaticFiles directory, that file or directory is als. which vulnerability.
Publish Date: 2023-05-16
URL: WS-2023-0138
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px
Release Date: 2023-05-16
Fix Resolution: 0.28.0
Step up your Open Source Security Game with Mend here