Bug 1216581 (CVE-2023-46136) - VUL-0: CVE-2023-46136: python-Werkzeug: denial of service by sending crafted multipart data to an endpoint
Summary: VUL-0: CVE-2023-46136: python-Werkzeug: denial of service by sending crafted ...
Status: RESOLVED FIXED
Alias: CVE-2023-46136
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/382981/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-46136:7.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-10-26 04:55 UTC by SMASH SMASH
Modified: 2024-05-03 17:28 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2023-10-26 04:55:46 UTC 
Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-46136
Comment 2 Steve Kowalik 2023-10-27 03:09:40 UTC 
Factory is also impacted. I've updated it there first.
Comment 4 OBSbugzilla Bot 2023-10-27 04:35:03 UTC 
This is an autogenerated message for OBS integration:
This bug (1216581) was mentioned in
https://build.opensuse.org/request/show/1120656 Factory / python-Werkzeug
Comment 5 Maintenance Automation 2023-10-31 12:30:51 UTC 
SUSE-SU-2023:4288-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1216581
CVE References: CVE-2023-46136
Sources used:
openSUSE Leap 15.4 (src): python-Werkzeug-2.3.6-150400.6.6.1, python-Werkzeug-test-2.3.6-150400.6.6.1
openSUSE Leap 15.5 (src): python-Werkzeug-2.3.6-150400.6.6.1
Python 3 Module 15-SP4 (src): python-Werkzeug-2.3.6-150400.6.6.1
Python 3 Module 15-SP5 (src): python-Werkzeug-2.3.6-150400.6.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.