Resource exhaustion in Werkzeug - CVE-2024-49767

Vulnerability identifier: #VU99567

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-49767

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the werkzeug.formparser.MultiPartParser. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Werkzeug
watsonx.data
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Python 3 Module
openSUSE Leap
openEuler
Ubuntu
Anolis OS
IBM Concert Software
IBM Cloud Pak for Data System
IBM Cloud Pak for Security
IBM Process Mining
IBM Watson Knowledge Catalog in Cloud Pak for Data
Splunk User Behavior Analytics (UBA)
IBM Spectrum Protect Plus
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Automated Test Suite
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Qradar Advisor
IBM Fusion HCI
IBM Maximo Application Suite
QRadar Suite
watsonx Code Assistant for Ansible
Storage Ceph
Security QRadar EDR
IBM Cloud Pak for Watson AIOps
Maximo Application Suite - IoT Component
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Unified Data Repository
python3-werkzeug (Ubuntu package)
python-werkzeug-help
python-werkzeug
python3-werkzeug
python311-Werkzeug
python3-werkzeug-doc

Install updates from vendor's website.

Werkzeug - update to 3.0.6
IBM Concert Software - update to 1.0.5
IBM Cloud Pak for Data System - update to 1.0.10.0
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
IBM Process Mining - update to 2.0
watsonx.data - update to 2.3.1
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
watsonx Code Assistant for Ansible - update to 5.1.1
Splunk User Behavior Analytics (UBA) - update to 5.4.3
Storage Ceph - update to 8.1
IBM Spectrum Protect Plus - update to 10.1.17.1
python3-werkzeug (Ubuntu package) - addressed in versions 2.0.2+dfsg1-1ubuntu0.22.04.3, 3.0.1-3ubuntu0.2, 3.0.3-1ubuntu0.1
python-werkzeug-help - addressed in versions 2.0.3-5, 2.2.3-3
python-werkzeug - addressed in versions 2.0.3-5, 2.2.3-3
python3-werkzeug - addressed in versions 2.0.3-5, 2.2.3-3
python311-Werkzeug - update to 2.3.6-150400.6.12.1
Qradar Advisor - update to 2.6.6
IBM Fusion HCI - update to 2.9.0
python3-werkzeug-doc - update to 3.0.1-5
python3-werkzeug - update to 3.0.1-5
Security QRadar EDR - update to 3.12.14
IBM Cloud Pak for Watson AIOps - update to 4.8.0
Maximo Application Suite - IoT Component - addressed in versions 8.7.19, 8.8.15, 9.0.5
IBM Maximo Application Suite - addressed in versions 8.10.21, 8.11.18, 9.0.7

• https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2
• https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee
• https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b
• https://github.com/pallets/werkzeug/releases/tag/3.0.6

• Multiple vulnerabilities in Werkzeug
• SUSE update for python-Werkzeug
• Ubuntu update for python-werkzeug
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Fusion HCI
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Function Cloud Native Environment
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in QRadar Advisor With Watson for IBM QRadar SIEM
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Code Assistant On Prem
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in IBM Process Mining
• openEuler 24.03 LTS update for python-werkzeug
• openEuler 22.03 LTS SP4 update for python-werkzeug
• openEuler 22.03 LTS SP3 update for python-werkzeug
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Splunk User Behavior Analytics (UBA) update for third-party components
• Multiple vulnerabilities in IBM Storage Ceph
• Multiple vulnerabilities in IBM Cloud Pak for Data System
• Multiple vulnerabilities in IBM watsonx.data
• Anolis OS update for python-werkzeug