what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 9 of 9 RSS Feed

CVE-2023-25577

Status Candidate

Overview

Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.

Related Files

Red Hat Security Advisory 2023-7473-01
Posted Nov 30, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-7473-01 - Red Hat OpenShift Container Platform release 4.14.4 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service
systems | linux, redhat
advisories | CVE-2023-25577
SHA-256 | 4e80b1122c9d7b84f571b1383f71ee1610cedc4984feb2e0e2007b879b896f38
Debian Security Advisory 5470-1
Posted Aug 7, 2023
Authored by Debian | Site debian.org

Debian Linux Security Advisory 5470-1 - Several vulnerabilities were discovered in python-werkzeug, a collection of utilities for WSGI applications.

tags | advisory, vulnerability, python
systems | linux, debian
advisories | CVE-2023-23934, CVE-2023-25577
SHA-256 | fbfd0844807d42d5eb5a87ffa65a7a37c372c6b11c185ce8b31d829df350079a
Ubuntu Security Notice USN-5948-2
Posted Jun 21, 2023
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 5948-2 - USN-5948-1 fixed vulnerabilities in Werkzeug. This update provides the corresponding updates for Ubuntu 23.04. It was discovered that Werkzeug did not properly handle the parsing of nameless cookies. A remote attacker could possibly use this issue to shadow other cookies.

tags | advisory, remote, vulnerability
systems | linux, ubuntu
advisories | CVE-2023-23934, CVE-2023-25577
SHA-256 | ba83f0682203fee0c453506a48dc08ac74fabba29b013868628afba2887e223f
Red Hat Security Advisory 2023-1325-01
Posted May 18, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-1325-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.0. Issues addressed include bypass, denial of service, and information leakage vulnerabilities.

tags | advisory, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2022-2990, CVE-2022-3259, CVE-2022-41717, CVE-2022-41723, CVE-2022-41724, CVE-2022-41725, CVE-2023-0056, CVE-2023-0229, CVE-2023-0778, CVE-2023-25577, CVE-2023-25725
SHA-256 | 3c99969afc933e620ba374452c68f8593447bc9cc623598572b823c7da85ed1a
Red Hat Security Advisory 2023-1328-01
Posted May 18, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-1328-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. Issues addressed include denial of service and out of bounds read vulnerabilities.

tags | advisory, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2021-20329, CVE-2021-38561, CVE-2022-2990, CVE-2022-3259, CVE-2022-41717, CVE-2022-41723, CVE-2022-41724, CVE-2022-41725, CVE-2023-0056, CVE-2023-0229, CVE-2023-0778, CVE-2023-25577, CVE-2023-25725
SHA-256 | 3a4e6c17a1fad21c0a5fe97d77aab166a10953b20b4daadf02981ebeea2e43b3
Red Hat Security Advisory 2023-1327-01
Posted May 17, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-1327-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.0.

tags | advisory
systems | linux, redhat
advisories | CVE-2022-2990, CVE-2022-3259, CVE-2022-41717, CVE-2022-41723, CVE-2022-41724, CVE-2022-41725, CVE-2023-0056, CVE-2023-0229, CVE-2023-0778, CVE-2023-25577, CVE-2023-25725
SHA-256 | 73d153096202874a8cfb1a557a480fa67fb9a71dac3d3657403eddefd96eedc6
Red Hat Security Advisory 2023-1281-01
Posted Mar 16, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-1281-01 - An update for python-werkzeug is now available for Red Hat OpenStack Platform. Issues addressed include a remote shell upload vulnerability.

tags | advisory, remote, shell, python
systems | linux, redhat
advisories | CVE-2023-25577
SHA-256 | 987d8f013217b57d1857239f6881cfb726cc3c00c621957b53627dccfc7f4cd9
Ubuntu Security Notice USN-5948-1
Posted Mar 14, 2023
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 5948-1 - It was discovered that Werkzeug did not properly handle the parsing of nameless cookies. A remote attacker could possibly use this issue to shadow other cookies. It was discovered that Werkzeug could be made to process unlimited number of multipart form data parts. A remote attacker could possibly use this issue to cause Werkzeug to consume resources, leading to a denial of service.

tags | advisory, remote, denial of service
systems | linux, ubuntu
advisories | CVE-2023-23934, CVE-2023-25577
SHA-256 | 207d0bc3fb2eccfc91fe6aa3fafe7926b6b250363338d8de7dacdbc1a1962227
Red Hat Security Advisory 2023-1018-01
Posted Mar 1, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-1018-01 - An update for python-werkzeug is now available for Red Hat OpenStack Platform 17.0 (Wallaby). Issues addressed include a remote shell upload vulnerability.

tags | advisory, remote, shell, python
systems | linux, redhat
advisories | CVE-2023-25577
SHA-256 | 6cabeb616cc86e2cbaf9eeff580fc77e5c814243da7ceecee78741afbe444047
Page 1 of 1
Back1Next

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close