Security update for python-Werkzeug

This update for python-Werkzeug fixes the following issues: CVE-2024-49767: Fixed possible resource exhaustion when parsing file data in forms bsc1232449. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

CLSA-2024-1730227099 Fix CVE(s): CVE-2024-8925

SECURITY UPDATE: prevent erroneous parsing - debian/patches/CVE-2024-8925.patch: limit multipart/form-data boundaries size to prevent erroneous parsing - CVE-2024-8925...

CLSA-2024-1730226852 php: Fix of CVE-2024-8925

CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer...

CLSA-2024-1730141462 php: Fix of CVE-2024-8925

CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer...

CLSA-2024-1730139582 php: Fix of CVE-2024-8925

CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer...

php: Fix of CVE-2024-8925

CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer...

CLSA-2024-1730134476 php: Fix of 2 CVEs

CVE-2024-8927: Fix bypass of cgi.forceredirect configuration - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer...

Allocation of Resources Without Limits or Throttling

Overview Quart is an A Python ASGI web microframework with the same API as Flask Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in formparser.MultiPartParser. An attacker can cause the parser to consume more memory than the upload size, in...

GHSA-Q34M-JH98-GWM2 Werkzeug possible resource exhaustion when parsing file data in forms

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.maxformmemorysize setting. The Request.maxcontentlength setting, as well as resource limits provided by deployment software and platforms,...

CVE-2024-49767 Werkzeug possible resource exhaustion when parsing file data in forms

Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests e.g. all flask applications are vulnerable to a relatively simple but effective...

CVE-2024-49767

Werkzeug is a Web Server Gateway Interface web application library. Applications using "werkzeug.formparser.MultiPartParser" corresponding to a version of Werkzeug prior to 3.0.6 to parse "multipart/form-data" requests e.g. all flask applications are vulnerable to a relatively simple but effectiv...

CVE-2024-49767: Uncontrolled Resource Consumption

Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests e.g. all flask applications are vulnerable to a relatively simple but effective...

Werkzeug security vulnerabilities

Werkzeug is a comprehensive WSGI web application library open-sourced by Pallets. A security vulnerability exists in Werkzeug versions prior to 3.0.6 that stems from vulnerability to denial of service attacks when parsing multipart/form-data requests...

Fedora 40 : python-fastapi / python-openapi-core / python-platformio / etc (2024-f1615b58e6)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-f1615b58e6 advisory. Security fix for CVE-2024-47874. Starlette 0.40.0 October 15, 2024 This release fixes a Denial of service DoS via multipart/form-data requests. You can view...

Slackware: Security Advisory (SSA:2024-297-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] php81

New php81 packages are available for Slackware 15.0 to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/php81/php81-8.1.30-i586-1slack15.0.txz: Upgraded. This update fixes bugs and security issues: Bypass of CVE-2024-4577, Parameter Injection Vulnerability...

Denial Of Service (DoS)

Starlette is vulnerable to Denial of Service DoS. The vulnerability is due to the way Starlette handles multipart/form-data parts without a filename. Specifically, these parts are treated as text form fields and buffered in byte strings without any size limits, allowing for arbitrary large upload...

openSUSE 15 Security Update : python-starlette (SUSE-SU-2024:3719-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:3719-1 advisory. - CVE-2024-47874: Fixed possible DoS via parts size in multipart/form-data requests bsc1231689 Tenable has extracted the preceding description block directly...

openSUSE Security Advisory (SUSE-SU-2024:3719-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for php7

This update for php7 fixes the following issues: CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed bsc1231360 CVE-2024-8927: Fixed cgi.forceredirect configuration is bypassable due to an environment variable collision...