REDHAT-BUG-2491440: High severity pypi/starlette vulnerability
Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts maxfields and maxpartsize to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
starletteto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2491440?
The severity of REDHAT-BUG-2491440 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2491440?
To fix REDHAT-BUG-2491440, update Starlette to a version newer than 1.3.1.
What is the impact of REDHAT-BUG-2491440?
REDHAT-BUG-2491440 can lead to denial of service due to excessive resource consumption while parsing form data.
Which software is affected by REDHAT-BUG-2491440?
The software affected by REDHAT-BUG-2491440 is the Starlette framework versions from 0.4.1 to 1.3.1.
Is REDHAT-BUG-2491440 related to data parsing issues?
Yes, REDHAT-BUG-2491440 is related to data parsing issues specifically for application/x-www-form-urlencoded content type.