werkzeug@0.9.4 vulnerabilities

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in formparser.MultiPartParser(). An attacker can cause the parser to consume more memory than the upload size, in excess of max_form_memory_size, by sending malicious data in a non-file field of a multipart/form-data request.

Upgrade werkzeug to version 3.0.6 or higher.

Werkzeug is a WSGI web application library.

Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs(), which allows the improper handling of UNC paths beginning with /, in the safe_join() function. This allows an attacker to read some files on the affected server, if they are stored in an affected path.

Note: This is only exploitable on Windows systems using Python versions prior to 3.11.

Upgrade Werkzeug to version 3.0.6 or higher.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient hostname checks and the use of relative paths to resolve requests. When the debugger is enabled, an attacker can convince a user to enter their own PIN to interact with a domain and subdomain they control, and thereby cause malicious code to be executed.

The demonstrated attack vector requires a number of conditions that render this attack very difficult to achieve, especially if the victim application is running in the recommended configuration of not having the debugger enabled in production.

Upgrade werkzeug to version 3.0.3 or higher.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in multipart data parsing. An attacker can cause a denial of service and block worker processes from handling legitimate requests by sending crafted multipart data to an endpoint that will parse it, eventually exhausting or killing all available workers.

Exploiting this vulnerability is possible if the uploaded file starts with CR or LF and is followed by megabytes of data without these characters.

Upgrade werkzeug to version 2.3.8, 3.0.1 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) when parsing multipart form data. An attacker can trigger the opening of multipart files containing a large number of file parts, which are processed using request.data, request.form, request.files, or request.get_data(parse_form_data=False), consuming CPU, memory, or file handles resources. The amount of CPU time required can block worker processes from handling other requests. The amount of RAM required can trigger an out-of-memory and crash the process.

Upgrade werkzeug to version 2.2.3 or higher.

Affected versions of this package are vulnerable to Access Restriction Bypass that allows a malicious application on an adjacent subdomain to present "nameless" cookies that look like =value instead of key=value and have them accepted by the affected browser. For example, a cookie like =__Host-test=bad would be parsed as __Host-test=bad and the key treated as valid while the value is ignored.

Upgrade werkzeug to version 2.2.3 or higher.

Affected versions of this package are vulnerable to Directory Traversal in SharedDataMiddleware via the os.path.join() function, when fetching requested files. When exploiting this vulnerability a path segment with a drive name will change the drive of the final path.

Note: This vulnerability is exploitable only in Windows environments.

Upgrade werkzeug to version 0.15.5 or higher.

Werkzeug is a WSGI web application library.

Affected versions of this package are vulnerable to Open Redirect. It is possible to redirect a user in werkzeug via a double slash in the URL.

Upgrade Werkzeug to version 0.11.6 or higher.

Werkzeug is a WSGI web application library.

Affected versions of this package are vulnerable to Insufficient Randomness. SHA1 hash algorithm is used with 1000 rounds for hashing. This deviates from security best practice.

Upgrade Werkzeug to version 0.12 or higher.

Werkzeug is a WSGI web application library.

Affected versions of this package are vulnerable to Insufficient Randomness when used with Docker, it has insufficient debugger PIN randomness because Docker containers share the same machine id.

Upgrade Werkzeug to version 0.15.3 or higher.

werkzeug is a comprehensive WSGI web application library.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.

Upgrade werkzeug to version 0.11.11 or higher.

werkzeug is the Swiss Army knife of Python web development.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks via the plaintext variable in the debug page.