Headline
Red Hat Security Advisory 2023-1018-01
Red Hat Security Advisory 2023-1018-01 - An update for python-werkzeug is now available for Red Hat OpenStack Platform 17.0 (Wallaby). Issues addressed include a remote shell upload vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256==================================================================== Red Hat Security AdvisorySynopsis: Important: Red Hat OpenStack Platform 17.0 (python-werkzeug) security updateAdvisory ID: RHSA-2023:1018-01Product: Red Hat OpenStack PlatformAdvisory URL: https://access.redhat.com/errata/RHSA-2023:1018Issue date: 2023-02-28CVE Names: CVE-2023-25577====================================================================1. Summary:An update for python-werkzeug is now available for Red Hat OpenStackPlatform 17.0 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.2. Relevant releases/architectures:Red Hat OpenStack Platform 17.0 - noarch3. Description:Werkzeug ======== Werkzeug started as simple collection of variousutilities for WSGI applications and has become one of the most advancedWSGI utility modules. It includes a powerful debugger, full featuredrequest and response objects, HTTP utilities to handle entity tags, cachecontrol headers, HTTP dates, cookie handling, file uploads, a powerful URLrouting system and a bunch of community contributed addon modules. Werkzeugis unicode aware and doesn't enforce a specific template engine, databaseadapter or anything else. It doesn't even enforce a specific way ofhandling requests and leaves all that up to the developer. It's most usefulfor end user applications which should work on as many server environmentsas possible (such as blogs, wikis, bulletin boards, etc.).Security Fix(es):* high resource usage when parsing multipart form data with many fields(CVE-2023-25577)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.4. Solution:For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/112585. Bugs fixed (https://bugzilla.redhat.com/):2170242 - CVE-2023-25577 python-werkzeug: high resource usage when parsing multipart form data with many fields6. Package List:Red Hat OpenStack Platform 17.0:Source:python-werkzeug-2.0.1-5.el9ost.src.rpmnoarch:python3-werkzeug-2.0.1-5.el9ost.noarch.rpmThese packages are GPG signed by Red Hat for security. Our key anddetails on how to verify the signature are available fromhttps://access.redhat.com/security/team/key/7. References:https://access.redhat.com/security/cve/CVE-2023-25577https://access.redhat.com/security/updates/classification/#important8. Contact:The Red Hat security contact is <[email protected]>. More contactdetails at https://access.redhat.com/security/team/contact/Copyright 2023 Red Hat, Inc.-----BEGIN PGP SIGNATURE-----Version: GnuPG v1iQIVAwUBY/5H8NzjgjWX9erEAQjf4Q/8DnrQ+Ji1TgF+Fnjwjqke9gySyRrJHkBrn2RzGxF8VMz3SA8nqo9NJhdU0aAQ/zKCC5U12FvaPRzZodCdYPVopsb1ZsaaFKtyA6gZjOElinGOpdjA4Szm6pTMQ3487PiOryqkP+tbDG4p4cbhwrSZ9A+yn3Fc0mfrMyBV4wjl3NzO17jQU7tJ6C39ccYm8q9h5jZP23BrAiO2FK0cKpF0shOFOkX52dbfl/KAhhpzlZ9j37cQeWt8EkfS+m2IjW9l2Azajs5VCLouhm+AdrLPmOi5MObe0yifPxSAJehx8kH3b7HjL8hTZYla1rTEQWMxJ6VfzDRUOxZCUO1aZmNffQ7W+yn6k6wHjOfA0HY6mAMj7A5QIZEp1nnhkr0OqUaZc1R4ISheHJVdIs4dUaYefjHuKiimPOv3qXu9oSSEY1B1vjsZ/3wr2PeXAL/lNpS/wj32F+fmL5vbTIfbZM58RlpYXOYkExzKyZlRQ7eoTnE5W24CjQXv8KNn5lgxnTffcyRFuaIAY0tYbfVZ741u+6Nal1Za78X3MBhBV6ENF2udzRtDxl/0qaeKf3+lD8yhSIuKBxfLKroAPpNtO13aWJrOPcrYcuynTMGdkmF9uULMOys85XXe1GmNATGBZLT8JRVSMzy7gdQHhPvwBLyLgDZmhbgI/FGPj36AQcv2TFo=XRFX-----END PGP SIGNATURE-------RHSA-announce mailing [email protected]://listman.redhat.com/mailman/listinfo/rhsa-announceRelated news
Red Hat Security Advisory 2023-7473-01 - Red Hat OpenShift Container Platform release 4.14.4 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.
Debian Linux Security Advisory 5470-1 - Several vulnerabilities were discovered in python-werkzeug, a collection of utilities for WSGI applications.
Ubuntu Security Notice 5948-2 - USN-5948-1 fixed vulnerabilities in Werkzeug. This update provides the corresponding updates for Ubuntu 23.04. It was discovered that Werkzeug did not properly handle the parsing of nameless cookies. A remote attacker could possibly use this issue to shadow other cookies.
Red Hat Security Advisory 2023-1325-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.0. Issues addressed include bypass, denial of service, and information leakage vulnerabilities.
Red Hat Security Advisory 2023-1326-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.13.0. Issues addressed include bypass, denial of service, information leakage, out of bounds read, and remote SQL injection vulnerabilities.
Red Hat OpenShift Container Platform release 4.13.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2990: An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has d...
Red Hat OpenShift Container Platform release 4.13.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4235: A flaw was found in go-yaml. This issue occurs due to unbounded alias chasing, where a maliciously crafted YAML file can cause the system to consume significant system resources. If p...
Red Hat Security Advisory 2023-1327-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.0.
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through...
Red Hat Security Advisory 2023-1281-01 - An update for python-werkzeug is now available for Red Hat OpenStack Platform. Issues addressed include a remote shell upload vulnerability.
An update for python-werkzeug is now available for Red Hat OpenStack Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-25577: A flaw was found in python-werkzeug. Werkzeug is multipart form data parser, that will parse an unlimited number of parts, including file parts. These parts can be a small amount of bytes, but each requires CPU time to parse, and may use more memory as Python data. If a request can be made to an endpoint that accesses request.data, reque...
Ubuntu Security Notice 5948-1 - It was discovered that Werkzeug did not properly handle the parsing of nameless cookies. A remote attacker could possibly use this issue to shadow other cookies. It was discovered that Werkzeug could be made to process unlimited number of multipart form data parts. A remote attacker could possibly use this issue to cause Werkzeug to consume resources, leading to a denial of service.
An update for python-werkzeug is now available for Red Hat OpenStack Platform 17.0 (Wallaby). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-25577: A flaw was found in python-werkzeug. Werkzeug is multipart form data parser, that will parse an unlimited number of parts, including file parts. These parts can be a small amount of bytes, but each requires CPU time to parse, and may use more memory as Python data. If a request can be made to an endpoint that accesses requ...
Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.