Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in formparser.MultiPartParser(). An attacker can cause the parser to consume more memory than the upload size, in excess of max_form_memory_size, by sending malicious data in a non-file field of a multipart/form-data request.

Remediation

Upgrade werkzeug to version 3.0.6 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Infinite loop where an attacker can cause the application to stop responding by initiating a loop through functions affecting the Path module, such as joinpath, the overloaded division operator, and iterdir.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade zipp to version 3.19.1 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS). The POLY1305 MAC (message authentication code) implementation might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting AVX512-IFMA instructions. If an attacker can influence whether the POLY1305 MAC algorithm is used in an application, the application state might be corrupted with various application dependent consequences, the most likely of which being denial of service. The maintainers are currently not aware of any concrete application that would be affected by this issue.

NOTES:

This vulnerability is only exploitable on Windows.

The FIPS provider is not affected by this issue.

Workaround

Disable AVX512-IFMA instructions by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 41.0.4 or higher.

References

• Github Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• RedHat Bugzilla Bug
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in multipart data parsing. An attacker can cause a denial of service and block worker processes from handling legitimate requests by sending crafted multipart data to an endpoint that will parse it, eventually exhausting or killing all available workers.

Exploiting this vulnerability is possible if the uploaded file starts with CR or LF and is followed by megabytes of data without these characters.

Remediation

Upgrade werkzeug to version 2.3.8, 3.0.1 or higher.

References

• GitHub Commit
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation through the NameChain DNS verification logic in src/rust/cryptography-x509-verification. An attacker can make a peer name, such as bar.example.com, validate against a wildcard leaf certificate like *.example.com even when an issuing certificate in the chain excludes that DNS subtree, causing improper certificate acceptance.

Notes

• The flaw affects X.509 path validation when DNS name constraints are present, and the leaf certificate uses a wildcard DNS SAN.
• The maintainers note that ordinary X.509 topologies, including those used by the Web PKI, are not affected, and exploitation requires an uncommon certificate hierarchy.

Remediation

Upgrade cryptography to version 46.0.6 or higher.

References

• GitHub Commit
• Maintainer's Advisory

Overview

Werkzeug is a WSGI web application library.

Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs(), which allows the improper handling of UNC paths beginning with /, in the safe_join() function. This allows an attacker to read some files on the affected server, if they are stored in an affected path.

Note: This is only exploitable on Windows systems using Python versions prior to 3.11.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade Werkzeug to version 3.0.6 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via the safe_join function. An attacker can cause the application to hang indefinitely by requesting a path ending with a Windows special device name, e.g. CON or NUL.

Note: This is only vulnerable on Windows, where special device names are implicitly present in every directory.

Remediation

Upgrade werkzeug to version 3.1.4 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via the safe_join() function, which permits path segments containing Windows special device names with file extensions or trailing spaces. An attacker can access unintended files or devices by crafting malicious path inputs.

Note:

This issues exists due to the incomplete fix for CVE-2025-66221 that failed to account for compound extensions such as CON.txt.html or trailing spaces.

Remediation

Upgrade werkzeug to version 3.1.5 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via the safe_join function. An attacker can cause the application to hang indefinitely by requesting a path ending with a Windows special device name.

Notes:

1. This is only vulnerable on Windows, where special device names are implicitly present in every directory;

2. This is a bypass of CVE-2025-66221, as the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL.

Remediation

Upgrade werkzeug to version 3.1.6 or higher.

References

• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS). If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows), this results in a denial of service when the affected process hangs.

NOTE: Policy processing being enabled on a publicly-facing server is not considered to be a common setup.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub Issue (Python)
• RedHat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a read buffer overflow in certificate name constraint checking in x509/v3_ncons.c. This occurs after certificate chain signature verification, and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• Node.js Advisory
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a double free after calling the PEM_read_bio_ex() function. An attacker who supplies a malicious PEM file with a 0-length payload can trigger a crash.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• Node.js Advisory
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) due to an invalid pointer dereference in the d2i_PKCS7(), d2i_PKCS7_bio() and d2i_PKCS7_fp(). An attacker could trigger a crash by supplying malicious PKCS7 data.

NOTE: The TLS implementation in OpenSSL does not call these functions.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• Node.js Advisory
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a null dereference when validating DSA public keys in the EVP_PKEY_public_check() function.

NOTE: The TLS implementation in OpenSSL does not call this function.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• Node.js Advisory
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) when processing specially crafted ASN.1 objects identifiers. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a exploitation of this vulnerability.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 41.0.0 or higher.

References

• GitHub Commit
• GitHub Commit
• PoC
• RedHat Bugzilla Bug
• Security Advisory

Overview

Affected versions of this package are vulnerable to NULL Pointer Dereference when loading PKCS7 certificates. An attacker can cause a Denial of Service (DoS) by attempting to deserialize a PKCS7 blob/certificate.

Note:

This is only exploitable if the load_pem_pkcs7_certificates or load_der_pkcs7_certificates functions are called.

PoC

from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates

pem_p7 = b"""
-----BEGIN PKCS7-----
MAsGCSqGSIb3DQEHAg==
-----END PKCS7-----
"""

der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"

load_pem_pkcs7_certificates(pem_p7)
load_der_pkcs7_certificates(der_p7)

Remediation

Upgrade cryptography to version 41.0.6 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Resource Exhaustion via the EVP_PKEY_public_check function. When the function is called in RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is a large prime, this computation takes a long time. An attacker can cause a denial of service by supplying a specially crafted RSA key that triggers extensive computation.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 42.0.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• OpenSSL Advisory
• RedHat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Use After Free in the BIO_new_NDEF() function. A new filter BIO can be freed, with the function returning a NULL result indicating a failure. But the BIO passed by the caller still holds pointers to the previously freed filter BIO. This could allow an attacker to cause a crash.

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub PR
• Node.js Advisory
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to NULL Pointer Dereference when processing a maliciously formatted PKCS12 file. The vulnerability exists due to improper handling of optional ContentInfo fields, which can be set to null. An attacker can cause a denial of service by sending crafted input that leads to applications loading files in PKCS12 format from untrusted sources to terminate abruptly.

Remediation

Upgrade cryptography to version 42.0.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• OpenSSL Advisory

Overview

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the xmlattr filter, when using keys containing spaces in an application accepts keys as user input. An attacker can inject arbitrary HTML attributes into the rendered HTML template, bypassing the auto-escaping mechanism, which may lead to the execution of untrusted scripts in the context of the user's browser session.

Note Accepting keys as user input is not common or a particularly intended use case of the xmlattr filter, and an application doing so should already be verifying what keys are provided regardless of this fix.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade Jinja2 to version 3.1.3 or higher.

References

• GitHub Commit
• GitHub Release
• Snyk Blog

Overview

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the xmlattr filter. An attacker can manipulate the output of web pages by injecting additional attributes into elements, potentially leading to unauthorized actions or information disclosure.

Note: This vulnerability derives from an improper fix of CVE-2024-22195, which only addressed spaces but not other characters.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade Jinja2 to version 3.1.4 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Improper Neutralization when importing a macro in a template whose filename is also a template. This will result in a SyntaxError: f-string: invalid syntax error message because the filename is not properly escaped, indicating that it is being treated as a format string.

Note: This is only exploitable when the attacker controls both the content and filename of a template and the application executes untrusted templates.

Remediation

Upgrade jinja2 to version 3.1.5 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub PR
• GitHub Release

Overview

Affected versions of this package are vulnerable to Template Injection when an attacker controls the content of a template. This is due to an oversight in the sandboxed environment's method detection when using a stored reference to a malicious string's format method, which can then be executed through a filter.

Note: This is only exploitable through custom filters in an application.

Remediation

Upgrade jinja2 to version 3.1.5 or higher.

References

• GitHub Commit
• GitHub Release
• Jinja Chnanges

Overview

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.

Affected versions of this package are vulnerable to Template Injection through the |attr filter. An attacker that controls the content of a template can escape the sandbox and execute arbitrary Python code by using the |attr filter to get a reference to a string's plain format method, bypassing the environment's attribute lookup.

Note:

This is only exploitable if the application executes untrusted templates.

Remediation

Upgrade Jinja2 to version 3.1.6 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) in the DH_check(), DH_check_ex() and EVP_PKEY_param_check() functions, which are used to check a DH key or DH parameters.

When the key or parameters that are being checked contain an excessively large modulus value (the p parameter) this may cause slowness in processing. Some checks use the supplied modulus value even if it has already been found to be too large.

The OpenSSL dhparam and pkeyparam command line applications are also vulnerable, when using the -check option.

NOTE: The OpenSSL SSL/TLS implementation is not affected by this issue.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 41.0.3 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• RedHat Bugzilla Bug
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) when the DH_generate_key(), DH_check_pub_key(), DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate() functions are used. An attacker can cause long delays and potentially a Denial of Service by supplying excessively long X9.42 DH keys or parameters obtained from an untrusted source.

Note:

This is only exploitable if the application uses these functions to generate or check an X9.42 DH key or parameters. Also, the OpenSSL pkey command line application, when using the -pubcheck option, as well as the OpenSSL genpkey command line application, are vulnerable to this issue.

Remediation

Upgrade cryptography to version 42.0.0 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• RedHat Bugzilla Bug
• Security Advisory

Overview

Affected versions of this package are vulnerable to Missing Cryptographic Step when the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() functions are used. An attacker can cause truncation or overreading of key and initialization vector (IV) lengths by altering the "keylen" or "ivlen" parameters within the OSSL_PARAM array after the key and IV have been established. This can lead to potential truncation or overruns during the initialization of some symmetric ciphers, such as RC2, RC4, RC5, CCM, GCM, and OCB. A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes.

Both truncations and overruns of the key and the IV will produce incorrect results and could, in some cases, trigger a memory exception.

Remediation

Upgrade cryptography to version 41.0.5 or higher.

References

• GitHub Commit
• GitHub Commit
• Security Advisory

Overview

Affected versions of this package are vulnerable to Timing Attack in rsa/rsa_ossl.c. An attacker can recover ciphertext with a Bleichenbacher style attack by sending a large number of trial messages (Marvin). This affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP, and RSASVE.

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• Node.js Advisory
• Vulnerability Advisory
• Vulnerability Report

Overview

Affected versions of this package are vulnerable to HTTP Response Splitting via mod_proxy_uwsgi. Special characters in the origin response header can truncate/split the response forwarded to the client.

Remediation

Upgrade uWSGI to version 2.0.22 or higher.

References

• GitHub Commit
• httpd advisory
• RedHat Bugzilla Bug
• uWSGI Changelog

Overview

Affected versions of this package are vulnerable to Expected Behavior Violation in Cipher.update_into, which allows immutable objects (such as bytes) to be mutated, violating fundamental rules of Python. This allows programmers to misuse an API, and cannot be exploited by attacker-controlled data alone.

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit

LGPL-3.0 license