Description
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Encode | Starlette | versions 0.13.5 and later and prior to 0.27.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | starlette | 0.28.0-1 | — |
| Debian 13 | starlette | 0.28.0-1 | — |
| Debian 12 | starlette | 0.26.1-1+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | starlette | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | starlette | >= 0.13.5, < 0.27.0 | 0.27.0 | GHSA-v5gw-mw7f-84px |
Advisories 1
- WID-SEC-2024-0423 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024