Bug 2318804
| Summary: | CVE-2024-47874 python-starlette: Starlette Denial of service (DoS) via multipart/form-data [fedora-all] | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Robb Gatica <rgatica> |
| Component: | python-starlette | Assignee: | Ben Beasley <code> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 40 | CC: | code, paul.wouters, rominf |
| Target Milestone: | --- | Keywords: | Security, SecurityTracking |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | {"flaws": ["43261923-5aea-4867-84c4-9ceffe4a615a"]} | ||
| Fixed In Version: | python-starlette-0.40.0-1.fc42 python-starlette-0.40.0-1.fc40 python-starlette-0.40.0-1.fc41 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2024-10-15 18:25:07 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2318801 | ||
|
Description
Robb Gatica
2024-10-15 16:29:07 UTC
Wow, that was fast! Starlette 0.40.0 was released ten hours ago. This explains why FastAPI adjusted its version pins to allow Starlette 0.40 a few days ago even though 0.39 was the latest release – I thought that was odd, as usually FastAPI lags a little bit in adopting new releases. It should be possible to update Starlette to 0.40 in all Fedora releases that now have Starlette 0.39 – F42/Rawhide, F41, and F40 – although a couple of dependent patches will need to be patched to allow the new dependency version. It’s likely not possible to confidently backport the fix to Fedora 39, which fortunately is almost at end of life. FEDORA-2024-466c574575 (python-openapi-core-0.19.4-4.fc42, python-platformio-6.1.16-2.fc42, and 1 more) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2024-466c574575 FEDORA-2024-466c574575 (python-openapi-core-0.19.4-4.fc42, python-platformio-6.1.16-2.fc42, and 1 more) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2024-05dedb1a53 (python-fastapi-0.115.2-1.fc41, python-openapi-core-0.19.4-4.fc41, and 2 more) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2024-05dedb1a53 FEDORA-2024-f1615b58e6 (python-fastapi-0.111.1-7.fc40, python-openapi-core-0.19.4-3.fc40, and 2 more) has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2024-f1615b58e6 FEDORA-2024-f1615b58e6 has been pushed to the Fedora 40 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-f1615b58e6` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-f1615b58e6 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2024-05dedb1a53 has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-05dedb1a53` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-05dedb1a53 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2024-f1615b58e6 (python-fastapi-0.111.1-7.fc40, python-openapi-core-0.19.4-3.fc40, and 2 more) has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2024-05dedb1a53 (python-fastapi-0.115.2-1.fc41, python-openapi-core-0.19.4-4.fc41, and 2 more) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report. |