Homepage
About Snyk

prefect@0.8.1 vulnerabilities

Workflow orchestration and management.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the prefect package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Server-side Request Forgery (SSRF)

prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) when Prefect API is exposed to "external" users of any kind. An attacker can maliciously craft a notification URL that points to an internal API, resulting in potential information exposure, access to internal services, and private IP addresses.

How to fix Server-side Request Forgery (SSRF)?

Upgrade prefect to version 2.20.11, 3.0.2 or higher.

[,2.20.11) [3.0.0rc1,3.0.2)
  • M
Regular Expression Denial of Service (ReDoS)

prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the python-multipart.

Note: When trying to install the latest FastAPI, which depends on starlette library, prefect library cannot be installed due to version compatibility.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade prefect to version 2.15.0 or higher.

[,2.15.0)
  • H
Cross-site Request Forgery (CSRF)

prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to improper authentication. An attacker can potentially gain remote code execution, steal and alter secrets.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade prefect to version 2.16.5 or higher.

[,2.16.5)
  • M
Race Condition

prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest.

Affected versions of this package are vulnerable to Race Condition such that it's possible for the result directory to be created between the exists check and creation.

How to fix Race Condition?

Upgrade prefect to version 0.14.21 or higher.

[,0.14.21)
  • M
Information Exposure

prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest.

Affected versions of this package are vulnerable to Information Exposure. The vulnerability allows for the unintended exposure of sensitive information related to function argument names when an error occurs during parameter binding for a function.

How to fix Information Exposure?

Upgrade prefect to version 2.11.1 or higher.

[,2.11.1)
  • M
Information Exposure

prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest.

Affected versions of this package are vulnerable to Information Exposure due to storing the password in Postgres tasks' initialization methods.

How to fix Information Exposure?

Upgrade prefect to version 0.12.5 or higher.

[,0.12.5)
Go back to all versions of this package