mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-01-31 09:40:23 +00:00
996dddd658
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue. Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
42 lines
1.3 KiB
BlitzBasic
42 lines
1.3 KiB
BlitzBasic
SUMMARY = "The Swiss Army knife of Python web development"
|
|
DESCRIPTION = "\
|
|
Werkzeug started as simple collection of various utilities for WSGI \
|
|
applications and has become one of the most advanced WSGI utility modules. \
|
|
It includes a powerful debugger, full featured request and response objects, \
|
|
HTTP utilities to handle entity tags, cache control headers, HTTP dates, \
|
|
cookie handling, file uploads, a powerful URL routing system and a bunch \
|
|
of community contributed addon modules."
|
|
HOMEPAGE = "http://werkzeug.pocoo.org/"
|
|
LICENSE = "BSD-3-Clause"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.rst;md5=5dc88300786f1c214c1e9827a5229462"
|
|
|
|
PYPI_PACKAGE = "Werkzeug"
|
|
|
|
SRC_URI += "file://CVE-2023-25577.patch"
|
|
|
|
SRC_URI[sha256sum] = "f8e89a20aeabbe8a893c24a461d3ee5dad2123b05cc6abd73ceed01d39c3ae74"
|
|
|
|
inherit pypi setuptools3
|
|
|
|
CLEANBROKEN = "1"
|
|
|
|
RDEPENDS:${PN} += " \
|
|
${PYTHON_PN}-datetime \
|
|
${PYTHON_PN}-difflib \
|
|
${PYTHON_PN}-email \
|
|
${PYTHON_PN}-html \
|
|
${PYTHON_PN}-io \
|
|
${PYTHON_PN}-json \
|
|
${PYTHON_PN}-logging \
|
|
${PYTHON_PN}-netclient \
|
|
${PYTHON_PN}-netserver \
|
|
${PYTHON_PN}-numbers \
|
|
${PYTHON_PN}-pkgutil \
|
|
${PYTHON_PN}-pprint \
|
|
${PYTHON_PN}-simplejson \
|
|
${PYTHON_PN}-threading \
|
|
${PYTHON_PN}-unixadmin \
|
|
${PYTHON_PN}-misc \
|
|
${PYTHON_PN}-profile \
|
|
"
|