{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-46136", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-10-16T17:51:35.574Z", "datePublished": "2023-10-24T23:48:56.960Z", "dateUpdated": "2024-08-02T20:37:39.469Z"}, "containers": {"cna": {"title": "Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning", "problemTypes": [{"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw"}, {"name": "https://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2", "tags": ["x_refsource_MISC"], "url": "https://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2"}, {"url": "https://security.netapp.com/advisory/ntap-20231124-0008/"}], "affected": [{"vendor": "pallets", "product": "werkzeug", "versions": [{"version": "< 3.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-24T23:48:56.960Z"}, "descriptions": [{"lang": "en", "value": "Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1."}], "source": {"advisory": "GHSA-hrfv-mqp8-q5rw", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:39.469Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw"}, {"name": "https://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2"}, {"url": "https://security.netapp.com/advisory/ntap-20231124-0008/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6578217-312C-44C5-851E-7F6FC6C0F8C1", "versionEndExcluding": "2.3.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:palletsprojects:werkzeug:3.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "3ECAF2F0-90D0-4564-93A5-0EAE8B317123", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1."}, {"lang": "es", "value": "Werkzeug es una librer\u00eda completa de aplicaciones web WSGI. Si se carga un archivo que comienza con CR o LF y luego va seguido de megabytes de datos sin estos caracteres: todos estos bytes se agregan fragmento a fragmento en una matriz de bytes interna y la b\u00fasqueda de los l\u00edmites se realiza en un b\u00fafer en crecimiento. Esto permite a un atacante provocar una denegaci\u00f3n de servicio enviando datos multiparte manipulados a un endpoint que los analizar\u00e1. La cantidad de tiempo de CPU necesaria puede impedir que los procesos de trabajo manejen solicitudes leg\u00edtimas. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 3.0.1."}], "id": "CVE-2023-46136", "lastModified": "2024-11-21T08:27:57.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-10-25T18:17:36.753", "references": [{"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20231124-0008/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20231124-0008/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-407"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:7610", "cpe": "cpe:/a:redhat:openshift_ironic:4.12::el9", "package": "python-werkzeug-0:2.0.3-5.el9", "product_name": "Ironic content for Red Hat OpenShift Container Platform 4.12", "release_date": "2023-12-06T00:00:00Z"}, {"advisory": "RHSA-2023:7477", "cpe": "cpe:/a:redhat:openshift_ironic:4.13::el9", "package": "python-werkzeug-0:2.0.3-5.el9", "product_name": "Ironic content for Red Hat OpenShift Container Platform 4.13", "release_date": "2023-11-29T00:00:00Z"}, {"advisory": "RHSA-2023:7473", "cpe": "cpe:/a:redhat:openshift_ironic:4.14::el9", "package": "python-werkzeug-0:2.2.3-2.el9", "product_name": "Red Hat OpenShift Container Platform 4.14", "release_date": "2023-11-29T00:00:00Z"}, {"advisory": "RHSA-2024:0189", "cpe": "cpe:/a:redhat:openstack:17.1::el8", "package": "python-werkzeug-0:2.0.1-8.el8ost", "product_name": "Red Hat OpenStack Platform 17.1 for RHEL 8", "release_date": "2024-01-16T00:00:00Z"}, {"advisory": "RHSA-2024:0214", "cpe": "cpe:/a:redhat:openstack:17.1::el9", "package": "python-werkzeug-0:2.0.1-6.el9ost", "product_name": "Red Hat OpenStack Platform 17.1 for RHEL 9", "release_date": "2024-01-16T00:00:00Z"}], "bugzilla": {"description": "python-werkzeug: high resource consumption leading to denial of service", "id": "2246310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246310"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-407", "details": ["Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.", "A resource consumption flaw was found in python-werkzeug. If a specially crafted file is uploaded by a remote attacker, it may cause a denial of service."], "name": "CVE-2023-46136", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Affected", "package_name": "python-werkzeug", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Affected", "package_name": "python-werkzeug", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "python-werkzeug", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "python-werkzeug", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:openstack:16.1", "fix_state": "Will not fix", "package_name": "python-werkzeug", "product_name": "Red Hat OpenStack Platform 16.1"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Will not fix", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Will not fix", "package_name": "python-werkzeug", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "python-httpcore", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "python-werkzeug", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Affected", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Affected", "package_name": "python-werkzeug", "product_name": "Red Hat Storage 3"}], "public_date": "2023-10-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-46136\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-46136\nhttps://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2\nhttps://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw"], "statement": "The vulnerability found in python-werkzeug, which lets attackers carry out denial of service attacks by using carefully crafted multipart data, is considered a moderate issue because it could affect system resources and availability. When this vulnerability is exploited, it can cause the CPU to work excessively hard because the parsing mechanism keeps adding data chunks to an internal buffer without checking boundaries properly. This can result in legitimate requests being delayed or denied as worker processes get overloaded, affecting how well the web application performs and responds. While this problem doesn\u2019t directly compromise data integrity or confidentiality, exploiting it can disrupt the availability of the service, which is why it\u2019s seen as a moderate issue.", "threat_severity": "Moderate", "upstream_fix": "python-werkzeug 3.0.1"}