Critical Resource Exhaustion Vulnerability in Werkzeug Package
Summary
UBUNTU-CVE-2024-49767: Werkzeug is a Web Server Gateway Interface web application library. Affects python-werkzeug versions < 2.0.2+dfsg1-1ubuntu0.22.04.3. Fixed in 2.0.2+dfsg1-1ubuntu0.22.04.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Werkzeug is a comprehensive WSGI (Web Server Gateway Interface) web application library that provides utilities for building web applications in Python. It is widely used in frameworks like Flask for handling HTTP requests and responses. The library is known for its flexibility and ease of use, making it a popular choice among developers. However, a recent vulnerability has been identified that affects its ability to handle multipart form data, potentially leading to severe resource exhaustion.
Vulnerability Detail
The vulnerability arises from the werkzeug.formparser.MultiPartParser component, which is responsible for parsing multipart/form-data requests. Versions of Werkzeug prior to 3.0.6 are susceptible to a denial of service (DoS) attack where a specially crafted form submission can cause the parser to allocate excessive memory—up to 8 times the upload size. This can lead to significant resource exhaustion, potentially crashing the server and affecting availability. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.0.2+dfsg1-1ubuntu0.22.04.3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-werkzeugTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing rate limiting on file uploads or validating file sizes to mitigate the impact of this vulnerability. Additionally, you can monitor your server's memory usage closely to detect any unusual spikes.
Conclusion
The identified vulnerability in the Werkzeug package poses a significant risk due to its potential for resource exhaustion, which can lead to denial of service. It is crucial for developers using affected versions to upgrade to version 3.0.6 or later to ensure the security and stability of their applications. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without complex setups.
See every vulnerability recorded for python-werkzeug →
FAQ
The vulnerability allows for resource exhaustion through specially crafted multipart form submissions, leading to potential denial of service.
Versions prior to 3.0.6 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
Implement rate limiting on uploads and monitor memory usage to mitigate the effects of the vulnerability until you can upgrade.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-werkzeug.
