You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.
ℹ️ This issue was automatically closed by Mend because it is a duplicate of an existing issue: #630
mend-bolt-for-githubbot
changed the title
CVE-2023-46136 (High) detected in Werkzeug-2.2.3-py3-none-any.whl
CVE-2023-46136 (High) detected in Werkzeug-2.2.3-py3-none-any.whl - autoclosed
Feb 21, 2024
mend-bolt-for-githubbot
changed the title
CVE-2023-46136 (High) detected in Werkzeug-2.2.3-py3-none-any.whl
CVE-2023-46136 (High) detected in Werkzeug-2.2.3-py3-none-any.whl - autoclosed
Feb 21, 2024
CVE-2023-46136 - High Severity Vulnerability
Vulnerable Library - Werkzeug-2.2.3-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/f6/f8/9da63c1617ae2a1dec2fbf6412f3a0cfe9d4ce029eccbda6e1e4258ca45f/Werkzeug-2.2.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
Found in HEAD commit: b0f7c98d88f4f0ef7aa1b834668853b7092da5a4
Found in base branch: master
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.
Publish Date: 2023-10-25
URL: CVE-2023-46136
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-hrfv-mqp8-q5rw
Release Date: 2023-10-25
Fix Resolution: 3.0.1
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: