CVE-2022-29361 (High) detected in Werkzeug-1.0.1-py2.py3-none-any.whl - autoclosed
mend-bolt-for-github opened this issue · 1 comments
CVE-2022-29361 - High Severity Vulnerability
Vulnerable Library - Werkzeug-1.0.1-py2.py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/cc/94/5f7079a0e00bd6863ef8f1da638721e9da21e5bacee597595b318f71d62e/Werkzeug-1.0.1-py2.py3-none-any.whl
Path to dependency file: /backend/requirements.txt
Path to vulnerable library: /backend/requirements.txt
Dependency Hierarchy:
- Flask_Cors-3.0.9-py2.py3-none-any.whl (Root Library)
- Flask-1.1.2-py2.py3-none-any.whl
- ❌ Werkzeug-1.0.1-py2.py3-none-any.whl (Vulnerable Library)
- Flask-1.1.2-py2.py3-none-any.whl
Found in HEAD commit: e726ca4e59ed46043e300fe16d6cf883c6ebd22e
Found in base branch: main
Vulnerability Details
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body.
Publish Date: 2022-05-25
URL: CVE-2022-29361
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29361
Release Date: 2022-05-25
Fix Resolution: Werkzeug - 2.1.1
Step up your Open Source Security Game with Mend here
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.