Bug 2318804 - CVE-2024-47874 python-starlette: Starlette Denial of service (DoS) via multipart/form-data [fedora-all]
Summary: CVE-2024-47874 python-starlette: Starlette Denial of service (DoS) via multip...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: python-starlette
Version: 40
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Ben Beasley
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["43261923-5aea-4867-84c4-9...
Depends On:
Blocks: CVE-2024-47874
TreeView+ depends on / blocked
 
Reported: 2024-10-15 16:29 UTC by Robb Gatica
Modified: 2024-10-26 02:57 UTC (History)
3 users (show)

Fixed In Version: python-starlette-0.40.0-1.fc42 python-starlette-0.40.0-1.fc40 python-starlette-0.40.0-1.fc41
Clone Of:
Environment:
Last Closed: 2024-10-15 18:25:07 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Robb Gatica 2024-10-15 16:29:07 UTC
More information about this security flaw is available in the following bug:

https://bugzilla.redhat.com/show_bug.cgi?id=2318801

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Ben Beasley 2024-10-15 17:09:31 UTC
Wow, that was fast! Starlette 0.40.0 was released ten hours ago. This explains why FastAPI adjusted its version pins to allow Starlette 0.40 a few days ago even though 0.39 was the latest release – I thought that was odd, as usually FastAPI lags a little bit in adopting new releases.

It should be possible to update Starlette to 0.40 in all Fedora releases that now have Starlette 0.39 – F42/Rawhide, F41, and F40 – although a couple of dependent patches will need to be patched to allow the new dependency version.

It’s likely not possible to confidently backport the fix to Fedora 39, which fortunately is almost at end of life.

Comment 2 Fedora Update System 2024-10-15 18:22:20 UTC
FEDORA-2024-466c574575 (python-openapi-core-0.19.4-4.fc42, python-platformio-6.1.16-2.fc42, and 1 more) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-466c574575

Comment 3 Fedora Update System 2024-10-15 18:25:07 UTC
FEDORA-2024-466c574575 (python-openapi-core-0.19.4-4.fc42, python-platformio-6.1.16-2.fc42, and 1 more) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 4 Fedora Update System 2024-10-15 18:51:03 UTC
FEDORA-2024-05dedb1a53 (python-fastapi-0.115.2-1.fc41, python-openapi-core-0.19.4-4.fc41, and 2 more) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-05dedb1a53

Comment 5 Fedora Update System 2024-10-15 19:33:24 UTC
FEDORA-2024-f1615b58e6 (python-fastapi-0.111.1-7.fc40, python-openapi-core-0.19.4-3.fc40, and 2 more) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-f1615b58e6

Comment 6 Fedora Update System 2024-10-16 01:54:49 UTC
FEDORA-2024-f1615b58e6 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-f1615b58e6`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-f1615b58e6

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2024-10-16 02:03:04 UTC
FEDORA-2024-05dedb1a53 has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-05dedb1a53`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-05dedb1a53

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2024-10-24 01:28:19 UTC
FEDORA-2024-f1615b58e6 (python-fastapi-0.111.1-7.fc40, python-openapi-core-0.19.4-3.fc40, and 2 more) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2024-10-26 02:57:16 UTC
FEDORA-2024-05dedb1a53 (python-fastapi-0.115.2-1.fc41, python-openapi-core-0.19.4-4.fc41, and 2 more) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.