USN-5948-2: Werkzeug vulnerabilities
20 June 2023
Several security issues were fixed in Werkzeug.
Releases
Packages
- python-werkzeug - collection of utilities for WSGI applications
Details
USN-5948-1 fixed vulnerabilities in Werkzeug. This update provides the
corresponding updates for Ubuntu 23.04.
Original advisory details:
It was discovered that Werkzeug did not properly handle the parsing of
nameless cookies. A remote attacker could possibly use this issue to
shadow other cookies. (CVE-2023-23934)
It was discovered that Werkzeug could be made to process unlimited number
of multipart form data parts. A remote attacker could possibly use this
issue to cause Werkzeug to consume resources, leading to a denial of
service. (CVE-2023-25577)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 23.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-5948-1: python-werkzeug-doc, python3-werkzeug, python-werkzeug