Red Hat Security Advisory: RHOSP 17.1.4 (python-werkzeug) security update

Fixed packages 2

Vulnerabilities 1

• High 7.5
  CVE-2024-34069 Public exploit

  Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

  Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Wolfi PyPI
  May 6, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279451
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9976.json
• report
  https://access.redhat.com/security/cve/CVE-2024-34069
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34069
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34069
• article
  https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692
• article
  https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985