Safety vulnerability ID: 53325
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Werkzeug 2.2.3 includes a fix for CVE-2023-25577: Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses 'request.data', 'request.form', 'request.files', or 'request.get_data(parse_form_data=False)', it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.
https://github.com/pallets/werkzeug/security/advisories/GHSA-xg9f-g7g7-2323
Latest version: 3.0.3
The comprehensive WSGI web application library.
-------------
Released 2023-02-14
- Ensure that URL rules using path converters will redirect with strict slashes when
the trailing slash is missing. :issue:`2533`
- Type signature for ``get_json`` specifies that return type is not optional when
``silent=False``. :issue:`2508`
- ``parse_content_range_header`` returns ``None`` for a value like ``bytes */-1``
where the length is invalid, instead of raising an ``AssertionError``. :issue:`2531`
- Address remaining ``ResourceWarning`` related to the socket used by ``run_simple``.
Remove ``prepare_socket``, which now happens when creating the server. :issue:`2421`
- Update pre-existing headers for ``multipart/form-data`` requests with the test
client. :issue:`2549`
- Fix handling of header extended parameters such that they are no longer quoted.
:issue:`2529`
- ``LimitedStream.read`` works correctly when wrapping a stream that may not return
the requested size in one ``read`` call. :issue:`2558`
- A cookie header that starts with ``=`` is treated as an empty key and discarded,
rather than stripping the leading ``==``.
- Specify a maximum number of multipart parts, default 1000, after which a
``RequestEntityTooLarge`` exception is raised on parsing. This mitigates a DoS
attack where a larger number of form/file parts would result in disproportionate
resource use.
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application