Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service due to [CVE-2023-24762]

Summary FastAPI is used by IBM App Connect Enterprise Certified Container for internal HTTP communications. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service. This bulletin provides patch information to addres...

Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities

Summary QRadar Suite Software includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version. Vulnerability Details...

Regular Expression Denial Of Service (ReDoS)

fastapi is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the python-multipart dependency which utilized a Regex expression with inefficient complexity. An attacker can inject a malicious Content-Type header, which causes the application to hang while it...

Duplicate Advisory: FastAPI Content-Type Header ReDoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2jv5-9r88-3w3p. This link is maintained to preserve external references. Original Description Summary When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header,...

GHSA-93GM-QMQ6-W238 Duplicate Advisory: Starlette Content-Type Header ReDoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2jv5-9r88-3w3p. This link is maintained to preserve external references. Original Description Summary When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header,...

Duplicate Advisory: Starlette Content-Type Header ReDoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2jv5-9r88-3w3p. This link is maintained to preserve external references. Original Description Summary When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header,...

a2 (>=0.1.0, <=0.3.17), a7a1234 (1.0.0) +1957 more potentially affected by CVE-2024-24762 via fastapi (>=0.1.17, <=0.109.0)

fastapi PYPI version =0.1.17, =0.1.0, =0.1.10, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.0, =2022.0.0rc1, =0.1.0, =2.0.4, =0.5.1.dev0, =0.5.4 - adworld-render-worker 0.1.0 and more Source cves: CVE-2024-24762 Source advisory: OSV:PYSEC-2024-38...

PYSEC-2024-38

FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options. An attacker could send a custom-made Content-Type option that is very...

PYSEC-2024-38

FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options. An attacker could send a custom-made Content-Type option that is very...

CVE-2024-24762

CVE-2024-24762 affects python-multipart and describes a ReDoS in parsing the HTTP Content-Type header (options). An attacker can send a crafted Content-Type to exhaust CPU and stall the event loop. The vulnerability is fixed in version 0.0.7 by upstream patching the regex. Remediation is to upgra...

PT-2024-20540

Name of the Vulnerable Software and Affected Versions python-multipart versions prior to 0.0.7 FastAPI version 0.109.0 Description The vulnerability is related to a Regular Expression Denial of Service ReDoS in the python-multipart library, which is used by FastAPI to parse form data. An attacker...

GHSA-7VWR-G6PM-9HC8 Cookie leakage between different users in fastapi-proxy-lib

Impact In the implementation of version 0.0.1, requests from different user clients are processed using a shared httpx.AsyncClient. However, one oversight is that the httpx.AsyncClient will persistently store cookies based on the set-cookie response header sent by the target server and share thes...

Cookie leakage between different users in fastapi-proxy-lib

Impact In the implementation of version 0.0.1, requests from different user clients are processed using a shared httpx.AsyncClient. However, one oversight is that the httpx.AsyncClient will persistently store cookies based on the set-cookie response header sent by the target server and share thes...

PT-2023-32993 · Unknown · Fastapi-Proxy-Lib

Name of the Vulnerable Software and Affected Versions: fastapi-proxy-lib version 0.0.1 Description: The issue arises from the shared use of httpx.AsyncClient across different user clients, leading to the persistent storage of cookies based on the set-cookie response header. This results in a cook...

0x20bf (0.0.1), 2keys (0.5.1) +941 more potentially affected by CVE-2023-47641 via aiohttp (>=3.0.0b0, <=3.7.4.post0)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =1.0.0, =0.0.1, =1.0.2, =0.3.3, =0.1.0, =0.5.6.dev0, =1.7.0, =0.1.6, =0.1.8 and more Source cves: CVE-2023-47641 Source advisory: OSV:GHSA-XX9P-XXVH-7G8J...

piccolo SQL Injection via named transaction savepoints

Summary The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection as user provided input is passed directly to connection.execute... via f-strings. Details An excerpt of the Postgres savepoint handling: python async def savepointself, name:...

Fedora 39 : python-fastapi / python-starlette (2023-a96ec52457)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-a96ec52457 advisory. Update python-starlette to 0.27.0 and python-fastapi to 0.95.2. Fixes GHSA-v5gw-mw7f-84px Path traversal vulnerability in StaticFiles. Tenable has extracted...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), acmen (0.5.0) +394 more potentially affected by CVE-2023-38325 via cryptography (>=40.0.0, <=41.0.1)

cryptography PYPI version =40.0.0, =1.0.0, =0.0.1, =1.2.4, =0.0.12.dev6, =2023.4.0b0, =2.0.0, =0.0.12, =0.0.1, =0.0.7, =0.0.1, =0.1.9 - apify 1.1.0 and more Source cves: CVE-2023-38325 Source advisory: GHSA-CF7P-GM2M-833M...

a2 (>=0.1.0, <=0.3.17), a7a1234 (1.0.0) +1256 more potentially affected by CVE-2023-29159 via starlette (>=0.13.6, <=0.26.1)

starlette PYPI version =0.13.6, =0.1.0, =0.1.10, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =2022.0.0rc1, =0.1.0, =0.0.1, =0.1.0, =0.1.3 and more Source cves: CVE-2023-29159 Source advisory: OSV:PYSEC-2023-83...

Fedora: Security Advisory for python-fastapi (FEDORA-2023-9329cee69d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...