Tóm tắt nhanh
- CVE-2024-21624 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng nonebot2, nonebot (nonebot).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.49%, cao hơn 42.5% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 2.2.0 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| nonebot2 PyPI | ≥ 2.0.0a16, < 2.2.0≥ 2.0.1, < 2.2.0
| 2.2.0
|
| nonebot | = 2.0.0≥ 2.0.1, < 2.2.0
| 2.2.0
|
Mô tả
Impact
This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize MessageTemplate and incorporate user-provided data into templates.
Patches
The identified vulnerability has been remedied in fix #2509 and will be included in versions released after 2.1.3. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability.
Workarounds
A temporary workaround involves filtering underscores before incorporating user input into the message template.
References
Mô tả của NVD
nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí