starlette-0.14.2-py3-none-any.whl: 4 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - starlette-0.14.2-py3-none-any.whl

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/15/34/db1890f442a1cd3a2c761f4109a0eb4e63503218d70a8c8e97faa09a5500/starlette-0.14.2-py3-none-any.whl

Found in HEAD commit: 653435dffecc04a7e4fcc7cbf73f04258b4cc039

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (starlette version)	Remediation Possible**
WS-2023-0037	High	7.5	starlette-0.14.2-py3-none-any.whl	Direct	0.26.0	❌
CVE-2023-30798	High	7.5	starlette-0.14.2-py3-none-any.whl	Direct	0.26.0	❌
CVE-2023-29159	High	7.5	starlette-0.14.2-py3-none-any.whl	Direct	0.28.0	❌
WS-2023-0138	Low	3.7	starlette-0.14.2-py3-none-any.whl	Direct	0.28.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2023-0037

Vulnerable Library - starlette-0.14.2-py3-none-any.whl

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/15/34/db1890f442a1cd3a2c761f4109a0eb4e63503218d70a8c8e97faa09a5500/starlette-0.14.2-py3-none-any.whl

Dependency Hierarchy:

• ❌ starlette-0.14.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 653435dffecc04a7e4fcc7cbf73f04258b4cc039

Found in base branch: main

Vulnerability Details

A Denial of Service (DoS) vulnerability was discovered in starlette prior to 0.25.0. The MultipartParser using the package python-multipart accepts an unlimited number of multipart parts (form fields or files). Processing too many parts results in high CPU usage and high memory usage, eventually leading to an OOM process kill. This can be triggered by sending too many small form fields with no content, or too many empty files.

Publish Date: 2023-02-14

URL: WS-2023-0037

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-74m5-2c7w-9w3x

Release Date: 2023-02-14

Fix Resolution: 0.26.0

CVE-2023-30798

Vulnerable Library - starlette-0.14.2-py3-none-any.whl

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/15/34/db1890f442a1cd3a2c761f4109a0eb4e63503218d70a8c8e97faa09a5500/starlette-0.14.2-py3-none-any.whl

Dependency Hierarchy:

• ❌ starlette-0.14.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 653435dffecc04a7e4fcc7cbf73f04258b4cc039

Found in base branch: main

Vulnerability Details

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.

Publish Date: 2023-04-21

URL: CVE-2023-30798

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-30798

Release Date: 2023-04-21

Fix Resolution: 0.26.0

CVE-2023-29159

Vulnerable Library - starlette-0.14.2-py3-none-any.whl

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/15/34/db1890f442a1cd3a2c761f4109a0eb4e63503218d70a8c8e97faa09a5500/starlette-0.14.2-py3-none-any.whl

Dependency Hierarchy:

• ❌ starlette-0.14.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 653435dffecc04a7e4fcc7cbf73f04258b4cc039

Found in base branch: main

Vulnerability Details

Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.

Publish Date: 2023-06-01

URL: CVE-2023-29159

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v5gw-mw7f-84px

Release Date: 2023-06-01

Fix Resolution: 0.28.0

WS-2023-0138

Vulnerable Library - starlette-0.14.2-py3-none-any.whl

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/15/34/db1890f442a1cd3a2c761f4109a0eb4e63503218d70a8c8e97faa09a5500/starlette-0.14.2-py3-none-any.whl

Dependency Hierarchy:

• ❌ starlette-0.14.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 653435dffecc04a7e4fcc7cbf73f04258b4cc039

Found in base branch: main

Vulnerability Details

starlette before 0.27.0 is vulnerable to Path Traversal. When using StaticFiles, if there's a file or directory that starts with the same name as the StaticFiles directory, that file or directory is als. which vulnerability.

Publish Date: 2023-05-16

URL: WS-2023-0138

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v5gw-mw7f-84px

Release Date: 2023-05-16

Fix Resolution: 0.28.0