Python: уязвимости стека · Страница 193

Remote Code Execution in pypa/setuptools

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

• Обновитесь до 1.5.4-1ubuntu4+esm5
• Обновитесь до 20.0.2-5ubuntu1.10+esm2
• Обновитесь до 20.7.0-1ubuntu0.1~esm2
• Обновитесь до 3.3-1ubuntu2+esm2
• Обновитесь до 39.0.1-2ubuntu0.1+esm1
• Обновитесь до 44.0.0-2ubuntu0.1+esm1
• Обновитесь до 44.1.1-1.2ubuntu0.22.04.1+esm1
• Обновитесь до 45.2.0-1ubuntu0.2
• Обновитесь до 59.6.0-1.2ubuntu0.22.04.2
• Обновитесь до 66.1.1-1+deb12u1
• Обновитесь до 68.1.2-2ubuntu1.1
• Обновитесь до 70.0
• Обновитесь до 70.0.0
• Обновитесь до 70.3.0-2
• Обновитесь до 8.1.1-2ubuntu0.6+esm8
• Обновитесь до 9.0.1-2.3~ubuntu1.18.04.8+esm4

Malware package cipherbcrypt

Malicious package. Exfiltrated secrets to a target server.

Local File Inclusion in Solara

Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.

• Обновитесь до 1.35.1

Red-DiscordBot vulnerable to Incorrect Authorization in commands API

Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.

• Обновитесь до 3.5.10

Wagtail regular expression denial-of-service via search query parsing

Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthent

• Обновитесь до 5.2.6
• Обновитесь до 6.0.6
• Обновитесь до 6.1.3

Stored XSS in gaizhenbiao/chuanhuchatgpt

A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.

Denial of Service in gaizhenbiao/chuanhuchatgpt

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unrestricted server restart capability can severely disrupt service availability, cause data loss or corruption, and potentially compromise system integrity.

Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server unavailability, and potential data loss or corruption.

CVE-2024-39614

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

• Обновитесь до 1:1.11.11-1ubuntu1.21+esm5
• Обновитесь до 2:2.2.12-1ubuntu0.23
• Обновитесь до 2:3.2.12-2ubuntu1.12
• Обновитесь до 3:3.2.25-0+deb12u1
• Обновитесь до 3:4.2.11-1ubuntu1.1
• Обновитесь до 3:4.2.14-1
• Обновитесь до 4.2.14
• Обновитесь до 5.0.7

CVE-2024-39330

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

• Обновитесь до 1:1.11.11-1ubuntu1.21+esm5
• Обновитесь до 2:2.2.12-1ubuntu0.23
• Обновитесь до 2:3.2.12-2ubuntu1.12
• Обновитесь до 3:3.2.25-0+deb12u1
• Обновитесь до 3:4.2.11-1ubuntu1.1
• Обновитесь до 3:4.2.14-1
• Обновитесь до 4.2.14
• Обновитесь до 5.0.7

CVE-2024-39329

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.

• Обновитесь до 1:1.11.11-1ubuntu1.21+esm5
• Обновитесь до 2:2.2.12-1ubuntu0.23
• Обновитесь до 2:3.2.12-2ubuntu1.12
• Обновитесь до 3:3.2.25-0+deb12u1
• Обновитесь до 3:4.2.11-1ubuntu1.1
• Обновитесь до 3:4.2.14-1
• Обновитесь до 4.2.14
• Обновитесь до 5.0.7

CVE-2024-38875

An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

• Обновитесь до 1:1.11.11-1ubuntu1.21+esm5
• Обновитесь до 2:2.2.12-1ubuntu0.23
• Обновитесь до 2:3.2.12-2ubuntu1.12
• Обновитесь до 3:4.2.11-1ubuntu1.1
• Обновитесь до 3:4.2.14-1
• Обновитесь до 4.2.14
• Обновитесь до 5.0.7

PYSEC-2024-55

Malicious package. Exfiltrated secrets to a target server.

Denial of Service via crafted zip file in jaraco/zipp

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive,

• Обновитесь до 1.0.0-1ubuntu0.1
• Обновитесь до 1.0.0-3ubuntu0.1
• Обновитесь до 1.0.0-6+deb12u1
• Обновитесь до 1.0.0-6ubuntu0.1
• Обновитесь до 3.19.1
• Обновитесь до 3.19.2-1

Infinite Loop in aimhubio/aim

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections.

Khoj Open Redirect Vulnerability in Login Page

### Summary An attacker can use the `next` parameter on the login page to redirect a victim to a malicious page, while masking this using a legit-looking `app.khoj.dev` url. For example, `https://app.khoj.dev/login?next=//example.com` will redirect to the https://example.com page. ### Details The problem seems to be in this method: https://github.com/khoj-ai/khoj/blob/2667ef45449eb408ce1d7c393be04845be31e15f/src/khoj/routers/auth.py#L95 ### PoC Open the `https://app.khoj.dev/login?next=//example.com` url in a Gecko-based browser (Firefox). ### Impact The impact is low, and this could only be used in phishing attempts, but it's still a prob

• Обновитесь до 1.14.0

yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

### Impact yt-dlp's DouyuTV and DouyuShow extractors used a `cdn.bootcdn.net` URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using [PhantomJS](https://github.com/ariya/phantomjs). `bootcdn.net` is owned by the bad actor responsible for the [Polyfill JS supply chain attack](https://sansec.io/research/polyfill-supply-chain-attack) that has been ongoing since at least June 2023. While there is no evidence that PhantomJS has been targeted by or is vulnerable to any attacks carried out by the Polyfill JS act

• Обновитесь до 2024.07.07

Denial of Service via Quadratic Complexity in kjd/idna

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

• Обновитесь до 2.0-3ubuntu0.1~esm1
• Обновитесь до 2.6-1ubuntu0.1~esm1
• Обновитесь до 2.8-1ubuntu0.1
• Обновитесь до 20.0.2-5ubuntu1.10+esm2
• Обновитесь до 22.0.2+dfsg-1ubuntu0.7
• Обновитесь до 24.0+dfsg-1ubuntu1.3
• Обновитесь до 3.3-1+deb12u1
• Обновитесь до 3.3-1ubuntu0.1
• Обновитесь до 3.6-2.1
• Обновитесь до 3.6-2ubuntu0.1
• Обновитесь до 3.7
• Обновитесь до 8.1.1-2ubuntu0.6+esm8
• Обновитесь до 9.0.1-2.3~ubuntu1.18.04.8+esm4

Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna

vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like `/etc/passwd`, by exploiting the exposed SQL queries via a Python Flask API.

Certifi removes GLOBALTRUST root certificate

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

• Обновитесь до 2024.7.4
• Обновитесь до 2024.8.30-1