CVE-2024-49767
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-49767
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49767.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-49767
- Aliases
- Related
- Published
- 2024-10-25T20:15:04Z
- Modified
- 2024-10-30T02:56:23.034481Z
- Summary
- [none]
- Details
-
Werkzeug is a Web Server Gateway Interface web application library. Applications using
werkzeug.formparser.MultiPartParsercorresponding to a version of Werkzeug prior to 3.0.6 to parsemultipart/form-datarequests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue. - References
-
- https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2
- https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee
- https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b
- https://github.com/pallets/werkzeug/releases/tag/3.0.6
- https://security-tracker.debian.org/tracker/CVE-2024-49767
Affected packages
Debian:11 / python-werkzeug
Package
- Name
- python-werkzeug
- Purl
- pkg:deb/debian/python-werkzeug?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:12 / python-werkzeug
Package
- Name
- python-werkzeug
- Purl
- pkg:deb/debian/python-werkzeug?arch=source
Debian:13 / python-werkzeug
Package
- Name
- python-werkzeug
- Purl
- pkg:deb/debian/python-werkzeug?arch=source
Debian:11 / quart
Package
- Name
- quart
- Purl
- pkg:deb/debian/quart?arch=source
Debian:12 / quart
Package
- Name
- quart
- Purl
- pkg:deb/debian/quart?arch=source
Debian:13 / quart
Package
- Name
- quart
- Purl
- pkg:deb/debian/quart?arch=source
Git / github.com/pallets/quart
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pallets/quart
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- GIT
- Repo
- https://github.com/pallets/werkzeug
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
0.*
0.1
0.1.0
0.10
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.11
0.11.0
0.11.1
0.11.10
0.11.11
0.11.12
0.11.13
0.11.14
0.11.15
0.11.2
0.11.3
0.11.4
0.11.5
0.11.6
0.11.7
0.11.8
0.11.9
0.12
0.12.0
0.12.1
0.12.2
0.13
0.13.0
0.13.1
0.14
0.14.0
0.14.1
0.14.x
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.x
0.16.0
0.16.1
0.16.2
0.16.x
0.17.0
0.18.0
0.18.1
0.18.2
0.18.3
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.2
0.2.0
0.3
0.3.0
0.3.1
0.4
0.4.0
0.4.1
0.5
0.5.0
0.5.1
0.6
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
0.7.0
0.7.1
0.8
0.8.0
0.8.1
0.8.2
0.8.3
0.9
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
1.*
1.0.0
1.0.0rc1
1.0.1
1.0.x
2.*
2.0.0
2.0.0rc1
2.0.0rc2
2.0.0rc3
2.0.0rc4
2.0.0rc5
2.0.1
2.0.2
2.0.3
2.0.x
2.1.0
2.1.1
2.1.2
2.1.x
2.2.0
2.2.0a1
2.2.1
2.2.2
2.2.3
2.2.x
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.x
3.*
3.0.2
3.0.3
3.0.4
3.0.5