Description
schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-formencode | 1.0.1-1 | — |
| Debian 13 | python-formencode | 1.0.1-1 | — |
| Debian 12 | python-formencode | 1.0.1-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | formencode | >= 1.0, < 1.0.1 | 1.0.1 | GHSA-9jp4-68vc-r8wq |
| PyPI | formencode | < 1.0.1 | 1.0.1 | PYSEC-2009-5 |
References
- 30282 vdb-entry
- FEDORA-2008-6312 vendor-advisory
- http://sourceforge.net/tracker/index.php?func=detail&aid=1925164&group_id=91231&atid=596416
- formencode-chainedvalidators-sec-bypass(43878) vdb-entry
- 47082 vdb-entry
- 31163 third-party-advisory
- http://sourceforge.net/tracker/download.php?group_id=91231&atid=596416&file_id=271779&aid=1925164
- 31081 third-party-advisory