py3-werkzeug

4 results · Feed

• Medium 6.9
  CVE-2024-49767

  Werkzeug possible resource exhaustion when parsing file data in forms

  Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulner…

  pallets werkzeug Quart airflow-3 Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Oct 25, 2024
• Medium 6.3
  CVE-2024-49766

  Werkzeug safe_join not safe on Windows

  Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Wolfi PyPI
  Oct 25, 2024
• High 7.5
  CVE-2024-34069 Public exploit

  Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

  Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Wolfi PyPI
  May 6, 2024
• High 8.0
  CVE-2023-46136 Public exploit

  Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

  Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: a…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Debian Azure Linux Alpine Wolfi PyPI
  Oct 24, 2023