[Snyk:Medium] Werkzeug Inefficient Algorithmic Complexity (due on 05/23/2024)

[pkfec]

Overview

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in multipart data parsing. An attacker can cause a denial of service and block worker processes from handling legitimate requests by sending crafted multipart data to an endpoint that will parse it, eventually exhausting or killing all available workers.

Exploiting this vulnerability is possible if the uploaded file starts with CR or LF and is followed by megabytes of data without these characters.

https://app.snyk.io/org/fecgov/project/7382e6c8-8f69-4afb-b910-ff61101c54fb#issue-SNYK-PYTHON-WERKZEUG-6035177

Introduced through:

• Introduced through: [email protected] › [email protected] › [email protected]
• Introduced through: [email protected] › [email protected] › [email protected] › [email protected]
• Introduced through: [email protected] › [email protected] › [email protected] › [email protected] › [email protected]
• Introduced through: [email protected] › [email protected] › [email protected] › [email protected] › [email protected]

Related:

#5636

Remediation:

Pin werkzeug to version 2.3.8 or 3.0.1

Completion criteria:

• Pin werkzeug to version 2.3.8 or 3.0.1