CVE-2023-30798
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2023-30798
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 0.25.0-1 |
| debian | bullseye | affected | |
| debian | forky | fixed | 0.25.0-1 |
| debian | sid | fixed | 0.25.0-1 |
| debian | trixie | fixed | 0.25.0-1 |
References
- https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x
- https://nvd.nist.gov/vuln/detail/CVE-2023-30798
- https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa
- https://github.com/encode/starlette
- https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2023-48.yaml
- https://vulncheck.com/advisories/starlette-multipartparser-dos
- https://security-tracker.debian.org/tracker/CVE-2023-30798
Verify integrity in audit chain (admin only). AS-IS.