There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
CVE-2023-30798 - High Severity Vulnerability
The little ASGI library that shines.
Library home page: https://files.pythonhosted.org/packages/51/37/8ac52116984d6a0d8502ec2c7e4a4a78f862b76410cdb1a4bcb384c91cb3/starlette-0.20.4-py3-none-any.whl
Path to dependency file: /src/project/ai-rag-llm/ollama-repo-changes/requirements.txt
Path to vulnerable library: /tmp/ws-ua_20241123173544_ZRDILV/python_ACKMZH/202411231737521/env/lib/python3.8/site-packages/starlette-0.20.4.dist-info
Dependency Hierarchy: - :x: **starlette-0.20.4-py3-none-any.whl** (Vulnerable Library)
Found in HEAD commit: 92e57f9e81da15812523bf929f8ad33bdae5e967
Found in base branch: main
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
Publish Date: 2023-04-21
URL: CVE-2023-30798
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-30798
Release Date: 2023-04-21
Fix Resolution: 0.26.0
Step up your Open Source Security Game with Mend here