Python: уязвимости стека · Страница 190

CKAN has a Cross-site Scripting vector in the Datatables view plugin

CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites running CKAN >= 2.7.0 with the datatables_view plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data. This vulnerability has been fixed in CKAN 2.10.5 and 2.11.0.

• Обновитесь до 2.10.5

CKAN may leak Solr credentials via error message in package_search action

CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message. This has been patched in CKAN 2.10.5 and 2.11.0.

• Обновитесь до 2.10.5

Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.

• Обновитесь до 1.15.0

LF Edge eKuiper has a SQL Injection in sqlKvStore

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. This vulnerability is fixed in 1.14.2.

• Обновитесь до 1.14.2

Quadratic complexity parsing cookies with backslashes

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

• Обновитесь до 2.7.12-1ubuntu0~16.04.18+esm10
• Обновитесь до 2.7.17-1~18.04ubuntu1.13+esm5
• Обновитесь до 2.7.18-1~20.04.4+esm2
• Обновитесь до 2.7.6-8ubuntu0.6+esm20
• Обновитесь до 3.10.15
• Обновитесь до 3.11.10
• Обновитесь до 3.11.2-6+deb12u5
• Обновитесь до 3.12.6
• Обновитесь до 3.13.0rc2
• Обновитесь до 3.13.0~rc2-1
• Обновитесь до 3.5.2-2ubuntu0~16.04.13+esm14
• Обновитесь до 3.5.2-2ubuntu0~16.04.4~14.04.1+esm3
• Обновитесь до 3.8.10-0ubuntu1~20.04.12
• Обновитесь до 3.8.20
• Обновитесь до 3.9.20
• Обновитесь до 7.3.18+dfsg-1

Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the vulnerability allows an attacker to extract files to any desired location within the server running MobSF. This vulnerability is fixed in 4.0.7.

• Обновитесь до 4.0.7

Improper Access Control in corydolphin/flask-cors

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.

• Обновитесь до 3.0.8-2ubuntu0.1+esm1
• Обновитесь до 3.0.9-2ubuntu0.1
• Обновитесь до 4.0.0-1ubuntu0.1~esm1
• Обновитесь до 4.0.2
• Обновитесь до 5.0.0
• Обновитесь до 5.0.0-1

WebOb's location header normalization during redirect leads to open redirect

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.

• Обновитесь до 1.5.1-1ubuntu0.1~esm2
• Обновитесь до 1.8.8
• Обновитесь до 1:1.7.3-2ubuntu0.1~esm2
• Обновитесь до 1:1.8.5-2ubuntu0.1
• Обновитесь до 1:1.8.6-1.1ubuntu0.1
• Обновитесь до 1:1.8.7-1ubuntu0.1.24.04.1
• Обновитесь до 1:1.8.9-1

Streamlit Path Traversal Security Vulnerability on Windows

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.

• Обновитесь до 1.37.0

In aiohttp, compressed files as symlinks are not protected from path traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileRespo

• Обновитесь до 3.10.2
• Обновитесь до 3.10.3-2

JupyterHub has a privilege escalation vulnerability with the `admin:users` scope

JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting

• Обновитесь до 4.1.6
• Обновитесь до 5.1.0
• Обновитесь до 5.2.1+ds1-1

Open WebUI Stored Cross-Site Scripting

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

• Обновитесь до 0.3.14

Pulpcore: rbac permissions incorrectly assigned in tasks that create objects

A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their p

CVE-2024-42005

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

• Обновитесь до 2:3.2.12-2ubuntu1.13
• Обновитесь до 3:3.2.25-0+deb12u1
• Обновитесь до 3:4.2.11-1ubuntu1.2
• Обновитесь до 3:4.2.15-1
• Обновитесь до 4.2.15
• Обновитесь до 5.0.8

CVE-2024-41991

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

• Обновитесь до 1:1.11.11-1ubuntu1.21+esm6
• Обновитесь до 2:2.2.12-1ubuntu0.24
• Обновитесь до 2:3.2.12-2ubuntu1.13
• Обновитесь до 3:3.2.25-0+deb12u1
• Обновитесь до 3:4.2.11-1ubuntu1.2
• Обновитесь до 3:4.2.15-1
• Обновитесь до 4.2.15
• Обновитесь до 5.0.8

CVE-2024-41990

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

• Обновитесь до 1:1.11.11-1ubuntu1.21+esm6
• Обновитесь до 2:2.2.12-1ubuntu0.24
• Обновитесь до 2:3.2.12-2ubuntu1.13
• Обновитесь до 3:4.2.11-1ubuntu1.2
• Обновитесь до 3:4.2.15-1
• Обновитесь до 4.2.15
• Обновитесь до 5.0.8

CVE-2024-41989

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

• Обновитесь до 1:1.11.11-1ubuntu1.21+esm6
• Обновитесь до 2:2.2.12-1ubuntu0.24
• Обновитесь до 2:3.2.12-2ubuntu1.13
• Обновитесь до 3:3.2.25-0+deb12u1
• Обновитесь до 3:4.2.11-1ubuntu1.2
• Обновитесь до 3:4.2.15-1
• Обновитесь до 4.2.15
• Обновитесь до 5.0.8

Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow

Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.   * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended

• Обновитесь до 1.2.2

Openstack-heat: incomplete fix for cve-2023-1625

An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.

Email header injection due to unquoted newlines

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

• Обновитесь до 2.7.12-1ubuntu0~16.04.18+esm12
• Обновитесь до 2.7.17-1~18.04ubuntu1.13+esm7
• Обновитесь до 2.7.18-1~20.04.5
• Обновитесь до 2.7.6-8ubuntu0.6+esm21
• Обновитесь до 3.10.15
• Обновитесь до 3.11.10
• Обновитесь до 3.11.2-6+deb12u5
• Обновитесь до 3.12.5
• Обновитесь до 3.13.0rc2
• Обновитесь до 3.13.0~rc2-1
• Обновитесь до 3.8.10-0ubuntu1~20.04.12
• Обновитесь до 3.8.20
• Обновитесь до 3.9.20
• Обновитесь до 7.3.18+dfsg-1