CVE-2023-46136: Werkzeug - High Resource Consumption Leading to Denial of Service
Summary
CVE-2023-46136: Werkzeug is a comprehensive WSGI web application library. Affects python-werkzeug across 2 version ranges.
< 2.2.2-3+deb12u1
< f3c803b3ade485a45f12b6d6617595350c0f03e2
Fixed in 2.2.2-3+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Werkzeug is a comprehensive WSGI web application library. It provides a set of utilities for building web applications, handling HTTP requests, and managing routing. Werkzeug is widely used in Python web development frameworks such as Flask and Django. However, version 2.0.3 of Werkzeug is vulnerable to a high resource consumption issue that can lead to a denial of service attack.
Vulnerability Detail
The vulnerability in Werkzeug arises when an upload of a file begins with a carriage return (CR) or line feed (LF) character, followed by megabytes of data without these characters. The library appends all of these bytes chunk by chunk into an internal bytearray and performs a lookup for a boundary on the growing buffer. An attacker can exploit this behavior by sending crafted multipart data to an endpoint that will parse it. This can result in a denial of service attack, as the excessive CPU time required to process the malicious data can block worker processes from handling legitimate requests. The vulnerability has been assigned the CVE identifier CVE-2023-46136 and has a CVSS score of 5.7 (Medium severity).
How To Fix
Minimum fixed version
2.2.2-3+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-werkzeugTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Werkzeug.
Conclusion
In conclusion, Werkzeug version 2.0.3 is vulnerable to a high resource consumption issue that can result in a denial of service attack. It is crucial to upgrade to either version 3.0.1 or version 2.3.8 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-werkzeug →
FAQ
Werkzeug is a comprehensive WSGI web application library for Python. It provides utilities for handling HTTP requests, routing, and building web applications.
Version 2.0.3 of Werkzeug is known to be vulnerable. It is recommended to upgrade to either version 3.0.1 or version 2.3.8, which contain the necessary patches.
The vulnerability can lead to a denial of service attack by consuming excessive CPU time, blocking worker processes from handling legitimate requests.
No, there is no known workaround. It is crucial to apply the recommended fix by upgrading to the patched versions of Werkzeug.
The CVSS score of this vulnerability is 5.7, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-werkzeug.
