REDHAT-BUG-2481742: Medium severity pypi/starlette vulnerability
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the Host header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing request.url and falls back to scope["server"] for malformed values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Starletteto a version that resolves this vulnerability.Fixed in 1.0.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2481742?
The severity of REDHAT-BUG-2481742 is rated at 47, indicating a significant risk.
How do I fix REDHAT-BUG-2481742?
To fix REDHAT-BUG-2481742, upgrade to Starlette version 1.0.1 or later.
What vulnerabilities are associated with REDHAT-BUG-2481742?
REDHAT-BUG-2481742 is associated with vulnerabilities in HTTP header validation leading to potential security issues.
Which software is affected by REDHAT-BUG-2481742?
REDHAT-BUG-2481742 affects the Starlette framework, specifically versions prior to 1.0.1.
What are the implications of not addressing REDHAT-BUG-2481742?
Failing to address REDHAT-BUG-2481742 can lead to security risks related to the manipulation of the 'Host' header.