요약
- CVE-2024-49767은(는) quart, werkzeug, quart (palletsprojects)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 1.1%, 전체 취약점의 65.6%보다 높음.
- 조치: 0.20.0, 3.0.6, 0.19.7 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| quart PyPI | < 0.20.0
| 0.20.0
|
| werkzeug PyPI | ≥ 2.0.0rc1, < 3.0.6
| 3.0.6
|
| quart | < 0.19.7
| 0.19.7
|
| werkzeug | < 3.0.6
| 3.0.6
|
Description
Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max_form_memory_size setting.
The Request.max_content_length setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
NVD description
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free