Tóm tắt nhanh
- CVE-2024-49767 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng quart, werkzeug, quart (palletsprojects).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.1%, cao hơn 65.6% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 0.20.0, 3.0.6, 0.19.7 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| quart PyPI | < 0.20.0
| 0.20.0
|
| werkzeug PyPI | ≥ 2.0.0rc1, < 3.0.6
| 3.0.6
|
| quart | < 0.19.7
| 0.19.7
|
| werkzeug | < 3.0.6
| 3.0.6
|
Mô tả
Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max_form_memory_size setting.
The Request.max_content_length setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
Mô tả của NVD
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí