fastapi-0.85.1-py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

[mend-bolt-for-github]

Vulnerable Library - fastapi-0.85.1-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 68d115ad0aacbf19b0abc84553a687bf13beee40

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (fastapi version)	Remediation Available
WS-2023-0037	High	7.5	starlette-0.20.4-py3-none-any.whl	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

WS-2023-0037

Vulnerable Library - starlette-0.20.4-py3-none-any.whl

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/51/37/8ac52116984d6a0d8502ec2c7e4a4a78f862b76410cdb1a4bcb384c91cb3/starlette-0.20.4-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• fastapi-0.85.1-py3-none-any.whl (Root Library)
  • ❌ starlette-0.20.4-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 68d115ad0aacbf19b0abc84553a687bf13beee40

Found in base branch: main

Vulnerability Details

A Denial of Service (DoS) vulnerability was discovered in starlette prior to 0.25.0. The MultipartParser using the package python-multipart accepts an unlimited number of multipart parts (form fields or files). Processing too many parts results in high CPU usage and high memory usage, eventually leading to an OOM process kill. This can be triggered by sending too many small form fields with no content, or too many empty files.

Publish Date: 2023-02-14

URL: WS-2023-0037

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-74m5-2c7w-9w3x

Release Date: 2023-02-14

Fix Resolution: starlette - 0.25.0

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.