Summary
[0.12.2-4.0.1]
- Fix CVE-2023-23934 [Orabug: 35662419]
- Fix CVE-2023-25577 [Orabug: 35662419]
- enable tests [Orabug: 35662419]
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | python3-werkzeug | 0:0.12.2-4.0.1.el8 |
Vulnerabilities 2
-
High 7.5
Werkzeug may allow high resource usage when parsing multipart form data with many fields
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse an…
-
Low 2.6
Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie l…