Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource()
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed s
Session Cookie without Secure and HTTPOnly flags in taipy
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
### Summary
Indirect CVEs affect Taipy 3.1.1
### Details
Taipy 3.1.1 is affected by two existing CVEs:
CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0
CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1
Please see References for further details.
### Patch
please upgrade to the following versions:
Fixed on patch versions: >=3.1.2
and on major releases: >=4.0.0
### Impact
pre-commit breaks when using dependency Taipy 3.1.1