diff --git a/advisories/github-reviewed/2024/10/GHSA-q34m-jh98-gwm2/GHSA-q34m-jh98-gwm2.json b/advisories/github-reviewed/2024/10/GHSA-q34m-jh98-gwm2/GHSA-q34m-jh98-gwm2.json index dd78199fe2cff..d0311106ca443 100644 --- a/advisories/github-reviewed/2024/10/GHSA-q34m-jh98-gwm2/GHSA-q34m-jh98-gwm2.json +++ b/advisories/github-reviewed/2024/10/GHSA-q34m-jh98-gwm2/GHSA-q34m-jh98-gwm2.json @@ -9,13 +9,9 @@ "summary": "Werkzeug possible resource exhaustion when parsing file data in forms", "details": "Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.\n\nThe `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.", "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ @@ -54,14 +50,11 @@ "introduced": "0" }, { - "fixed": "0.19.7" + "fixed": "0.20.0" } ] } - ], - "database_specific": { - "last_known_affected_version_range": "<= 0.19.6" - } + ] } ], "references": [ @@ -77,10 +70,18 @@ "type": "WEB", "url": "https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee" }, + { + "type": "WEB", + "url": "https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f" + }, { "type": "WEB", "url": "https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b" }, + { + "type": "WEB", + "url": "https://github.com/pallets/quart/releases/tag/0.20.0" + }, { "type": "PACKAGE", "url": "https://github.com/pallets/werkzeug" @@ -94,7 +95,7 @@ "cwe_ids": [ "CWE-400" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-10-25T19:44:43Z", "nvd_published_at": "2024-10-25T20:15:04Z"