Description
The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Recurly | recurly python module | Versions before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | recurly | >= 2.6.0, < 2.6.2 | 2.6.2 | GHSA-38rv-5jqc-m2cv |
| PyPI | recurly | >= 2.5.0, < 2.5.1 | 2.5.1 | GHSA-38rv-5jqc-m2cv |
| PyPI | recurly | >= 2.4.0, < 2.4.5 | 2.4.5 | GHSA-38rv-5jqc-m2cv |
| PyPI | recurly | >= 2.3.0, < 2.3.1 | 2.3.1 | GHSA-38rv-5jqc-m2cv |
| PyPI | recurly | >= 2.2.0, < 2.2.22 | 2.2.22 | GHSA-38rv-5jqc-m2cv |
| PyPI | recurly | >= 2.1.0, < 2.1.16 | 2.1.16 | GHSA-38rv-5jqc-m2cv |
| PyPI | recurly | < 2.0.5 | 2.0.5 | GHSA-38rv-5jqc-m2cv |
| PyPI | recurly | >= 2.0, < 2.0.5 · >= 2.1, < 2.1.16 · >= 2.2, < 2.2.22 · >= 2.3, < 2.3.1 · >= 2.4, < 2.4.5 · >= 2.5, < 2.5.1 · >= 2.6, < 2.6.2 | 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 | PYSEC-2017-68 |