Python stack vulnerabilities · Page 190

Improper Access Control in corydolphin/flask-cors

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.

• Update to 3.0.8-2ubuntu0.1+esm1
• Update to 3.0.9-2ubuntu0.1
• Update to 4.0.0-1ubuntu0.1~esm1
• Update to 4.0.2
• Update to 5.0.0
• Update to 5.0.0-1

WebOb's location header normalization during redirect leads to open redirect

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.

• Update to 1.5.1-1ubuntu0.1~esm2
• Update to 1.8.8
• Update to 1:1.7.3-2ubuntu0.1~esm2
• Update to 1:1.8.5-2ubuntu0.1
• Update to 1:1.8.6-1.1ubuntu0.1
• Update to 1:1.8.7-1ubuntu0.1.24.04.1
• Update to 1:1.8.9-1

Streamlit Path Traversal Security Vulnerability on Windows

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.

• Update to 1.37.0

In aiohttp, compressed files as symlinks are not protected from path traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileRespo

• Update to 3.10.2
• Update to 3.10.3-2

JupyterHub has a privilege escalation vulnerability with the `admin:users` scope

JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting

• Update to 4.1.6
• Update to 5.1.0
• Update to 5.2.1+ds1-1

Open WebUI Stored Cross-Site Scripting

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

• Update to 0.3.14

Pulpcore: rbac permissions incorrectly assigned in tasks that create objects

A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their p

CVE-2024-42005

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

• Update to 2:3.2.12-2ubuntu1.13
• Update to 3:3.2.25-0+deb12u1
• Update to 3:4.2.11-1ubuntu1.2
• Update to 3:4.2.15-1
• Update to 4.2.15
• Update to 5.0.8

CVE-2024-41991

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

• Update to 1:1.11.11-1ubuntu1.21+esm6
• Update to 2:2.2.12-1ubuntu0.24
• Update to 2:3.2.12-2ubuntu1.13
• Update to 3:3.2.25-0+deb12u1
• Update to 3:4.2.11-1ubuntu1.2
• Update to 3:4.2.15-1
• Update to 4.2.15
• Update to 5.0.8

CVE-2024-41990

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

• Update to 1:1.11.11-1ubuntu1.21+esm6
• Update to 2:2.2.12-1ubuntu0.24
• Update to 2:3.2.12-2ubuntu1.13
• Update to 3:4.2.11-1ubuntu1.2
• Update to 3:4.2.15-1
• Update to 4.2.15
• Update to 5.0.8

CVE-2024-41989

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

• Update to 1:1.11.11-1ubuntu1.21+esm6
• Update to 2:2.2.12-1ubuntu0.24
• Update to 2:3.2.12-2ubuntu1.13
• Update to 3:3.2.25-0+deb12u1
• Update to 3:4.2.11-1ubuntu1.2
• Update to 3:4.2.15-1
• Update to 4.2.15
• Update to 5.0.8

Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow

Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.   * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended

• Update to 1.2.2

Openstack-heat: incomplete fix for cve-2023-1625

An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.

Email header injection due to unquoted newlines

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

• Update to 2.7.12-1ubuntu0~16.04.18+esm12
• Update to 2.7.17-1~18.04ubuntu1.13+esm7
• Update to 2.7.18-1~20.04.5
• Update to 2.7.6-8ubuntu0.6+esm21
• Update to 3.10.15
• Update to 3.11.10
• Update to 3.11.2-6+deb12u5
• Update to 3.12.5
• Update to 3.13.0rc2
• Update to 3.13.0~rc2-1
• Update to 3.8.10-0ubuntu1~20.04.12
• Update to 3.8.20
• Update to 3.9.20
• Update to 7.3.18+dfsg-1

PheonixAppAPI has visible Encoding Maps

Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. The issue is that the map of encoding/decoding languages are visible in code. The Problem was patched in 0.2.4.

• Update to 0.2.5

Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.

• Update to 4.0.5

Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. The vulnerability has been fixed with Haystack `2.3.1`.

• Update to 2.3.1

W&B Weave server remote arbitrary file leak and privilege escalation

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.

• Update to 0.50.8

Path Traversal in gaizhenbiao/chuanhuchatgpt

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.

TensorFlow segfault in array_ops.upper_bound

TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12.

• Update to 2.12.1