Open plural-renovate[bot] opened 6 months ago
Easy and customizable dashboards for your build system. Learn more about Stoat ↗︎
Name | Link | Commit | Status |
---|---|---|---|
api-coverage | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
rtc-coverage | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
core-coverage | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
cron-coverage | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
email-coverage | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
worker-coverage | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
api-test-results | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
graphql-coverage | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
rtc-test-results | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
core-test-results | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
cron-test-results | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
email-test-results | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
worker-test-results | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
graphql-test-results | Visit | a9918e9916ba73a3546bb1eaa4e914952104e897 | ✅ |
Easy and customizable dashboards for your build system. Learn more about Stoat ↗︎
Name | Link | Commit | Status |
---|---|---|---|
api-coverage | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
rtc-coverage | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
core-coverage | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
cron-coverage | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
email-coverage | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
worker-coverage | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
api-test-results | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
graphql-coverage | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
rtc-test-results | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
core-test-results | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
cron-test-results | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
email-test-results | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
worker-test-results | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
graphql-test-results | Visit | 24e45caf3d240aef11dfefb0ce0d7b27d9a0a419 | ✅ |
This PR contains the following updates:
==0.27.0
->==0.36.2
GitHub Vulnerability Alerts
CVE-2024-24762
Summary
When using form data,
python-multipart
uses a Regular Expression to parse the HTTPContent-Type
header, including options.An attacker could send a custom-made
Content-Type
option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests.This can create a ReDoS (Regular expression Denial of Service): https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
This only applies when the app uses form data, parsed with
python-multipart
.Details
A regular HTTP
Content-Type
header could look like:python-multipart
parses the option with this RegEx: https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74A custom option could be made and sent to the server to break it with:
PoC
Create a simple WSGI application, that just parses the
Content-Type
, and run it withpython main.py
:Then send the attacking request with:
Impact
It's a ReDoS, (Regular expression Denial of Service), it only applies to those reading form data. This way it also affects other libraries using Starlette, like FastAPI.
Original Report
This was originally reported to FastAPI as an email to security@tiangolo.com, sent via https://huntr.com/, the original reporter is Marcello, https://github.com/byt3bl33d3r
Original report to FastAPI
Hey Tiangolo! My name's Marcello and I work on the ProtectAI/Huntr Threat Research team, a few months ago we got a report (from @nicecatch2000) of a ReDoS affecting another very popular Python web framework. After some internal research, I found that FastAPI is vulnerable to the same ReDoS under certain conditions (only when it parses Form data not JSON). Here are the details: I'm using the latest version of FastAPI (0.109.0) and the following code: ```Python from typing import Annotated from fastapi.responses import HTMLResponse from fastapi import FastAPI,Form from pydantic import BaseModel class Item(BaseModel): username: str app = FastAPI() @app.get("/", response_class=HTMLResponse) async def index(): return HTMLResponse("Test", status_code=200) @app.post("/submit/") async def submit(username: Annotated[str, Form()]): return {"username": username} @app.post("/submit_json/") async def submit_json(item: Item): return {"username": item.username} ``` I'm running the above with uvicorn with the following command: ```console uvicorn server:app ``` Then run the following cUrl command: ``` curl -v -X 'POST' -H $'Content-Type: application/x-www-form-urlencoded; !=\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' --data-binary 'input=1' 'http://localhost:8000/submit/' ``` You'll see the server locks up, is unable to serve anymore requests and one CPU core is pegged to 100% You can even start uvicorn with multiple workers with the --workers 4 argument and as long as you send (workers + 1) requests you'll completely DoS the FastApi server. If you try submitting Json to the /submit_json endpoint with the malicious Content-Type header you'll see it isn't vulnerable. So this only affects FastAPI when it parses Form data. Cheers #### Impact An attacker is able to cause a DoS on a FastApi server via a malicious Content-Type header if it parses Form data. #### Occurrences [params.py L586](https://togithub.com/tiangolo/fastapi/blob/d74b3b25659b42233a669f032529880de8bd6c2d/fastapi/params.py#L586)Release Notes
encode/starlette (starlette)
### [`v0.36.2`](https://togithub.com/encode/starlette/releases/tag/0.36.2): Version 0.36.2 [Compare Source](https://togithub.com/encode/starlette/compare/0.36.1...0.36.2) #### Fixed - Upgrade `python-multipart` to `0.0.7` [13e5c26](13e5c26a27f4903924624736abd6131b2da80cc5). - Avoid duplicate charset on `Content-Type` [#2443](https://togithub.com/encode/starlette/2443). *** **Full Changelog**: https://github.com/encode/starlette/compare/0.36.1...0.36.2 ### [`v0.36.1`](https://togithub.com/encode/starlette/releases/tag/0.36.1): Version 0.36.1 [Compare Source](https://togithub.com/encode/starlette/compare/0.36.0...0.36.1) #### Fixed - Check if "extensions" in scope before checking the extension [#2438](http://togithub.com/encode/starlette/pull/2438). *** **Full Changelog**: https://github.com/encode/starlette/compare/0.36.0...0.36.1 ### [`v0.36.0`](https://togithub.com/encode/starlette/releases/tag/0.36.0): Version 0.36.0 [Compare Source](https://togithub.com/encode/starlette/compare/0.35.1...0.36.0) #### Added - Add support for ASGI `pathsend` extension [#2435](http://togithub.com/encode/starlette/pull/2435). - Cancel `WebSocketTestSession` on close [#2427](http://togithub.com/encode/starlette/pull/2427). - Raise `WebSocketDisconnect` when `WebSocket.send()` excepts `IOError` [#2425](http://togithub.com/encode/starlette/pull/2425). - Raise `FileNotFoundError` when the `env_file` parameter on `Config` is not valid [#2422](http://togithub.com/encode/starlette/pull/2422). *** **Full Changelog**: https://github.com/encode/starlette/compare/0.35.1...0.36.0 ### [`v0.35.1`](https://togithub.com/encode/starlette/releases/tag/0.35.1): Version 0.35.1 [Compare Source](https://togithub.com/encode/starlette/compare/0.35.0...0.35.1) #### Fixed - Stop using the deprecated "method" parameter in `FileResponse` inside of `StaticFiles` [#2406](https://togithub.com/encode/starlette/pull/2406). - Make `typing-extensions` optional again [#2409](https://togithub.com/encode/starlette/pull/2409). *** **Full Changelog**: https://github.com/encode/starlette/compare/0.35.0...0.35.1 ### [`v0.35.0`](https://togithub.com/encode/starlette/releases/tag/0.35.0): Version 0.35.0 [Compare Source](https://togithub.com/encode/starlette/compare/0.34.0...0.35.0) #### Added - Add `*args` to `Middleware` and improve its type hints [#2381](https://togithub.com/encode/starlette/pull/2381). #### Fixed - Use `Iterable` instead `Iterator` on `iterate_in_threadpool` [#2362](https://togithub.com/encode/starlette/pull/2362). #### Changes - Handle `root_path` to keep compatibility with mounted ASGI applications and WSGI [#2400](https://togithub.com/encode/starlette/pull/2400). - Turn `scope["client"]` to `None` on `TestClient` [#2377](https://togithub.com/encode/starlette/pull/2377). *** **Full Changelog**: https://github.com/encode/starlette/compare/0.34.0...0.35.0 ### [`v0.34.0`](https://togithub.com/encode/starlette/releases/tag/0.34.0): Version 0.34.0 [Compare Source](https://togithub.com/encode/starlette/compare/0.33.0...0.34.0) #### Added - Use `ParamSpec` for `run_in_threadpool` [#2375](https://togithub.com/encode/starlette/pull/2375). - Add `UploadFile.__repr__` [#2360](https://togithub.com/encode/starlette/pull/2360). #### Fixed - Merge URLs properly on `TestClient` [#2376](https://togithub.com/encode/starlette/pull/2376). - Take weak ETags in consideration on `StaticFiles` [#2334](https://togithub.com/encode/starlette/pull/2334). #### Deprecated - Deprecate `FileResponse(method=...)` parameter [#2366](https://togithub.com/encode/starlette/pull/2366). *** **Full Changelog**: https://github.com/encode/starlette/compare/0.33.0...0.34.0 ### [`v0.33.0`](https://togithub.com/encode/starlette/releases/tag/0.33.0): Version 0.33.0 [Compare Source](https://togithub.com/encode/starlette/compare/0.32.0.post1...0.33.0) #### Added - Add `middleware` per `Route`/`WebSocketRoute` [#2349](https://togithub.com/encode/starlette/pull/2349). - Add `middleware` per `Router` [#2351](https://togithub.com/encode/starlette/pull/2351). #### Fixed - Do not overwrite `"path"` and `"root_path"` scope keys [#2352](https://togithub.com/encode/starlette/pull/2352). - Set `ensure_ascii=False` on `json.dumps()` for `WebSocket.send_json()` [#2341](https://togithub.com/encode/starlette/pull/2341). ### [`v0.32.0.post1`](https://togithub.com/encode/starlette/releases/tag/0.32.0.post1): Version 0.32.0.post1 [Compare Source](https://togithub.com/encode/starlette/compare/0.32.0...0.32.0.post1) ##### Fixed - Revert mkdocs-material from 9.1.17 to 9.4.7 [#2326](https://togithub.com/encode/starlette/pull/2326). ### [`v0.32.0`](https://togithub.com/encode/starlette/releases/tag/0.32.0): Version 0.32.0 [Compare Source](https://togithub.com/encode/starlette/compare/0.31.1...0.32.0) #### Added - Send `reason` on `WebSocketDisconnect` [#2309](https:://togithub.com/encode/starlette/pull/2309). - Add `domain` parameter to `SessionMiddleware` [#2280](https:://togithub.com/encode/starlette/pull/2280). #### Changed - Inherit from `HTMLResponse` instead of `Response` on `_TemplateResponse` [#2274](https://togithub.com/encode/starlette/pull/2274). - Restore the `Response.render` type annotation to its pre-0.31.0 state [#2264](https://togithub.com/encode/starlette/pull/2264). *** **Full Changelog**: https://github.com/encode/starlette/compare/0.31.1...0.32.0 ### [`v0.31.1`](https://togithub.com/encode/starlette/releases/tag/0.31.1): Version 0.31.1 [Compare Source](https://togithub.com/encode/starlette/compare/0.31.0...0.31.1) ##### Fixed - Fix import error when `exceptiongroup` isn't available [#2231](https://togithub.com/encode/starlette/pull/2231). - Set `url_for` global for custom Jinja environments [#2230](https://togithub.com/encode/starlette/pull/2230). **Full Changelog**: https://github.com/encode/starlette/compare/0.31.0...0.31.1 ### [`v0.31.0`](https://togithub.com/encode/starlette/releases/tag/0.31.0): Version 0.31.0 [Compare Source](https://togithub.com/encode/starlette/compare/0.30.0...0.31.0) #### Added - Officially support Python 3.12 [#2214](https://togithub.com/encode/starlette/pull/2214). - Support AnyIO 4.0 [#2211](https://togithub.com/encode/starlette/pull/2211). - Strictly type annotate Starlette (strict mode on mypy) [#2180](https://togithub.com/encode/starlette/pull/2180). #### Fixed - Don't group duplicated headers on a single string when using the `TestClient` [#2219](https://togithub.com/encode/starlette/pull/2219). *** **Full Changelog**: https://github.com/encode/starlette/compare/0.30.0...0.31.0 ### [`v0.30.0`](https://togithub.com/encode/starlette/releases/tag/0.30.0): Version 0.30.0 [Compare Source](https://togithub.com/encode/starlette/compare/0.29.0...0.30.0) ##### Removed - Drop Python 3.7 support [#2178](https://togithub.com/encode/starlette/pull/2178). ### [`v0.29.0`](https://togithub.com/encode/starlette/releases/tag/0.29.0): Version 0.29.0 [Compare Source](https://togithub.com/encode/starlette/compare/0.28.0...0.29.0) #### Added - Add `follow_redirects` parameter to `TestClient` [#2207](https://togithub.com/encode/starlette/pull/2207). - Add `__str__` to `HTTPException` and `WebSocketException` [#2181](https://togithub.com/encode/starlette/pull/2181). - Warn users when using `lifespan` together with `on_startup`/`on_shutdown` [#2193](https://togithub.com/encode/starlette/pull/2193). - Collect routes from `Host` to generate the OpenAPI schema [#2183](https://togithub.com/encode/starlette/pull/2183). - Add `request` argument to `TemplateResponse` [#2191](https://togithub.com/encode/starlette/pull/2191). #### Fixed - Stop `body_stream` in case `more_body=False` on `BaseHTTPMiddleware` [#2194](https://togithub.com/encode/starlette/pull/2194). **Full Changelog**: https://github.com/encode/starlette/compare/0.28.0...0.29.0 ### [`v0.28.0`](https://togithub.com/encode/starlette/releases/tag/0.28.0): Version 0.28.0 [Compare Source](https://togithub.com/encode/starlette/compare/0.27.0...0.28.0) ##### Changed - Reuse `Request`'s body buffer for call_next in `BaseHTTPMiddleware` [#1692](https://togithub.com/encode/starlette/pull/1692). - Move exception handling logic to `Route` [#2026](https://togithub.com/encode/starlette/pull/2026). ##### Added - Add `env` parameter to `Jinja2Templates`, and deprecate `**env_options` [#2159](https://togithub.com/encode/starlette/pull/2159). - Add clear error message when `httpx` is not installed [#2177](https://togithub.com/encode/starlette/pull/2177). ##### Fixed - Allow "name" argument on `templates url_for()` [#2127](https://togithub.com/encode/starlette/pull/2127). **Full Changelog**: https://github.com/encode/starlette/compare/0.27.0...0.28.0Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.