CVE-2023-30798 (High) detected in starlette-0.13.6-py3-none-any.whl

[mend-bolt-for-github]

CVE-2023-30798 - High Severity Vulnerability

Vulnerable Library - starlette-0.13.6-py3-none-any.whl

The little ASGI library that shines.

Library home page: https://files.pythonhosted.org/packages/c5/a4/c9e228d7d47044ce4c83ba002f28ff479e542455f0499198a3f77c94f564/starlette-0.13.6-py3-none-any.whl

Path to dependency file: /tmp/ws-scm/JsMERG

Path to vulnerable library: /JsMERG

Dependency Hierarchy:

• ❌ starlette-0.13.6-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b766c4aafc268281f97cb694accb8ab77070c150

Found in base branch: main

Vulnerability Details

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.

Publish Date: 2023-04-21

URL: CVE-2023-30798

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-30798

Release Date: 2023-04-21

Fix Resolution: 0.26.0

---

Step up your Open Source Security Game with Mend here