There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
References
| Link | Resource |
|---|---|
| https://vulncheck.com/advisories/starlette-multipartparser-dos | Patch Third Party Advisory |
| https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x | Mitigation Vendor Advisory |
| https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa | Patch |
Configurations
History
28 Apr 2023, 03:47
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:* | |
| CWE | CWE-400 | |
| First Time |
Encode starlette
Encode |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x - Mitigation, Vendor Advisory | |
| References | (MISC) https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa - Patch | |
| References | (MISC) https://vulncheck.com/advisories/starlette-multipartparser-dos - Patch, Third Party Advisory |
21 Apr 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-21 16:15
Updated : 2023-04-28 03:47
NVD link : CVE-2023-30798
Mitre link : CVE-2023-30798
JSON object : View
Products Affected
encode
- starlette
CWE
CWE-400
Uncontrolled Resource Consumption