Path Traversal Vulnerability in Python Pyramid Package
Summary
DEBIAN-CVE-2023-40587: Pyramid is an open source Python web framework. Affects python-pyramid versions < 2.0.2+dfsg-1. Fixed in 2.0.2+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pyramid is an open-source Python web framework designed for building web applications. It is known for its flexibility and scalability, allowing developers to create applications ranging from simple to complex. The framework supports various features such as URL routing, templating, and security mechanisms. However, a recent vulnerability has been identified in versions 2.0.0 and 2.0.1 that affects users running Python 3.11, specifically when using a static view with a full filesystem path.
Vulnerability Detail
The vulnerability is a path traversal issue that allows unauthorized access to files outside the intended directory. It occurs when a static view in Pyramid is configured with a full filesystem path, and an 'index.html' file is located one directory above the static view's path. This flaw could lead to the accidental disclosure of the 'index.html' file. The vulnerability arises from the handling of null-bytes in file paths, which was not properly managed in the affected versions. Pyramid version 2.0.2 addresses this issue by rejecting paths containing null-bytes, and subsequent Python versions have also corrected the underlying problem in 'os.path.normpath'.
How To Fix
Minimum fixed version
2.0.2+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pyramidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version immediately, consider using a version of Python that is not affected, such as Python 3.10. Alternatively, you can temporarily downgrade your Python version until the fix is applied. To downgrade, use the command:
sudo apt-get install python3.10'.
Conclusion
In summary, the path traversal vulnerability in the Python Pyramid package poses a risk to applications using affected versions. It is crucial to update to the patched version or implement workarounds to mitigate the risk of unauthorized file access. Regular monitoring with tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for python-pyramid →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory, potentially leading to unauthorized data exposure.
Pyramid versions 2.0.0 and 2.0.1 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package, consider using Python 3.10 or downgrading your Python version temporarily until the fix is applied.
The primary implication is the potential exposure of sensitive files, such as 'index.html', which could lead to information disclosure and compromise the security of the application.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-pyramid.
