CVE-2024-49767
CVE Details
Visit the official vulnerability details page for CVE-2024-49767 to learn more.
Initial Publication
10/27/2024
Last Update
10/27/2024
Third Party Dependency
Werkzeug
NIST CVE Summary
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
CVE Severity
Our Official Summary
Investigation is ongoing to determine how this vulnerability impacts our products.
Status
Ongoing
Affected Products & Versions
| Version | Palette Enterprise | Palette Enterprise Airgap | VerteX | VerteX Airgap |
|---|---|---|---|---|
| 4.5.11 | Impacted | Impacted | Impacted | Impacted |
| 4.5.10 | Impacted | Impacted | Impacted | Impacted |
| 4.5.8 | Impacted | Impacted | Impacted | Impacted |
| 4.5.5 | Impacted | Impacted | Impacted | Impacted |
| 4.5.4 | Impacted | Impacted | Impacted | Impacted |
| 4.4.20 | Impacted | Impacted | Impacted | Impacted |
Revision History
| Date | Revision |
|---|---|
| 11/15/2024 | Impacted versions changed from 4.5.5, 4.5.8, 4.4.20, 4.5.10 to 4.5.5, 4.5.8, 4.4.20, 4.5.10, 4.5.11 |
| 11/15/2024 | Impacted versions changed from 4.5.5, 4.5.8, 4.4.20 to 4.5.5, 4.5.8, 4.4.20, 4.5.10 |
| 11/13/2024 | Impacted versions changed from 4.5.5, 4.5.8 to 4.5.5, 4.5.8, 4.4.20 |
| 11/10/2024 | Impacted versions changed from 4.5.5 to 4.5.5, 4.5.8 |
| 11/06/2024 | Advisory assigned with HIGH severity |