CVE-2021-23423: bikeshed Package HTML Output Disclosure
Summary
CVE-2021-23423: This affects the package bikeshed before 3.0.0. Affects bikeshed across 2 version ranges.
< 3.0.0
< b2f668fca204260b1cad28d5078e93471cb6b2dd
Fixed in b2f668fca204260b1cad28d5078e93471cb6b2dd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bikeshed package is a Python package available on PyPI. It is used for processing source files and generating HTML output. The package provides functionality for including external files in the HTML output using include, include-code, or include-raw blocks. However, before version 3.0.0, an untrusted source file containing these blocks could lead to the disclosure of arbitrary file contents in the HTML output.
Vulnerability Detail
The vulnerability (CVE-2021-23423) arises when the bikeshed package processes an untrusted source file with include, include-code, or include-raw blocks. This can result in the disclosure of arbitrary file contents in the generated HTML output. An attacker could exploit this vulnerability to access sensitive information contained in files that were not intended to be exposed. The impact of this vulnerability depends on the nature of the files that can be accessed and the sensitivity of the information they contain.
How To Fix
Minimum fixed version
b2f668fca204260b1cad28d5078e93471cb6b2dd
This is the first release that contains the fix.
pip install --upgrade "bikeshed==b2f668fca204260b1cad28d5078e93471cb6b2dd"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid processing untrusted source files with include, include-code, or include-raw blocks until they have upgraded to a fixed version of the bikeshed package.
Conclusion
The bikeshed package before version 3.0.0 is vulnerable to HTML output disclosure, which can lead to the exposure of arbitrary file contents. To mitigate this vulnerability, users should upgrade to version 3.0.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bikeshed →
FAQ
The vulnerability allows an attacker to access arbitrary file contents in the HTML output, potentially exposing sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
Yes, users can avoid processing untrusted source files with include, include-code, or include-raw blocks until they have upgraded to a fixed version of the bikeshed package.
To fix this vulnerability, it is recommended to upgrade to version 3.0.0 or later of the bikeshed package.
You can find more information about this vulnerability in the advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/bikeshed/PYSEC-2021-117.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for bikeshed.
