SB2023021673 - Multiple vulnerabilities in Werkzeug

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2023-23934)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of "nameless" cookies. A remote attacker can manipulate cookie values for an arbitrary domain.

2) Resource exhaustion (CVE-ID: CVE-2023-25577)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing multipart form data with many fields. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://github.com/pallets/werkzeug/security/advisories/GHSA-px8h-6qxv-m22q
• https://github.com/pallets/werkzeug/commit/cf275f42acad1b5950c50ffe8ef58fe62cdce028
• https://github.com/pallets/werkzeug/releases/tag/2.2.3
• https://github.com/pallets/werkzeug/commit/517cac5a804e8c4dc4ed038bb20dacd038e7a9f1
• https://github.com/pallets/werkzeug/security/advisories/GHSA-xg9f-g7g7-2323