search

heltondoria / contato-service

API de contatos em python
0 stars 0 forks source link

CVE-2022-29361 (High) detected in Werkzeug-0.15.4-py2.py3-none-any.whl - autoclosed #20

Closed mend-bolt-for-github[bot] closed 2 years ago

mend-bolt-for-github[bot] commented 2 years ago

CVE-2022-29361 - High Severity Vulnerability

Vulnerable Library - Werkzeug-0.15.4-py2.py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/9f/57/92a497e38161ce40606c27a86759c6b92dd34fcdb33f64171ec559257c02/Werkzeug-0.15.4-py2.py3-none-any.whl

Dependency Hierarchy: - :x: **Werkzeug-0.15.4-py2.py3-none-any.whl** (Vulnerable Library)

Found in HEAD commit: 1a5afe6f2bee27ef9b534c9b1a237934e6650293

Found in base branch: master

Vulnerability Details

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body.

Publish Date: 2022-05-25

URL: CVE-2022-29361

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29361

Release Date: 2022-05-25

Fix Resolution: Werkzeug - 2.1.1

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.