Show plain JSON{"affected_release": [{"advisory": "RHSA-2023:7610", "cpe": "cpe:/a:redhat:openshift_ironic:4.12::el9", "package": "python-werkzeug-0:2.0.3-5.el9", "product_name": "Ironic content for Red Hat OpenShift Container Platform 4.12", "release_date": "2023-12-06T00:00:00Z"}, {"advisory": "RHSA-2023:7477", "cpe": "cpe:/a:redhat:openshift_ironic:4.13::el9", "package": "python-werkzeug-0:2.0.3-5.el9", "product_name": "Ironic content for Red Hat OpenShift Container Platform 4.13", "release_date": "2023-11-29T00:00:00Z"}, {"advisory": "RHSA-2023:7473", "cpe": "cpe:/a:redhat:openshift_ironic:4.14::el9", "package": "python-werkzeug-0:2.2.3-2.el9", "product_name": "Red Hat OpenShift Container Platform 4.14", "release_date": "2023-11-29T00:00:00Z"}, {"advisory": "RHSA-2024:0189", "cpe": "cpe:/a:redhat:openstack:17.1::el8", "package": "python-werkzeug-0:2.0.1-8.el8ost", "product_name": "Red Hat OpenStack Platform 17.1 for RHEL 8", "release_date": "2024-01-16T00:00:00Z"}, {"advisory": "RHSA-2024:0214", "cpe": "cpe:/a:redhat:openstack:17.1::el9", "package": "python-werkzeug-0:2.0.1-6.el9ost", "product_name": "Red Hat OpenStack Platform 17.1 for RHEL 9", "release_date": "2024-01-16T00:00:00Z"}], "bugzilla": {"description": "python-werkzeug: high resource consumption leading to denial of service", "id": "2246310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246310"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-407", "details": ["Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.", "A resource consumption flaw was found in python-werkzeug. If a specially crafted file is uploaded by a remote attacker, it may cause a denial of service."], "name": "CVE-2023-46136", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Affected", "package_name": "python-werkzeug", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Affected", "package_name": "python-werkzeug", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "python-werkzeug", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "python-werkzeug", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:openstack:16.1", "fix_state": "Will not fix", "package_name": "python-werkzeug", "product_name": "Red Hat OpenStack Platform 16.1"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Will not fix", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Will not fix", "package_name": "python-werkzeug", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "python-httpcore", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "python-werkzeug", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Affected", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Affected", "package_name": "python-werkzeug", "product_name": "Red Hat Storage 3"}], "public_date": "2023-10-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-46136\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-46136\nhttps://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2\nhttps://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw"], "statement": "The vulnerability found in python-werkzeug, which lets attackers carry out denial of service attacks by using carefully crafted multipart data, is considered a moderate issue because it could affect system resources and availability. When this vulnerability is exploited, it can cause the CPU to work excessively hard because the parsing mechanism keeps adding data chunks to an internal buffer without checking boundaries properly. This can result in legitimate requests being delayed or denied as worker processes get overloaded, affecting how well the web application performs and responds. While this problem doesn\u2019t directly compromise data integrity or confidentiality, exploiting it can disrupt the availability of the service, which is why it\u2019s seen as a moderate issue.", "threat_severity": "Moderate"} 
MITRE
Vulnrichment
NVD
Redhat