Upgrading starlette 0.24 to 0.25
Safe0.24.0 → 0.25.0Security1Fixed1
SecurityThere MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.GHSA-74m5-2c7w-9w3x · CVE-2023-30798 ↗
SafeUpgrade verdict
A security fix. Nothing to change in your code.
In plain terms
- There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
Must act 1 item needs code or config changes
What you must change
Security1
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
API changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- removed:
class MultiPartMessage(Enum) - removed:
field MultiPartMessage.END - removed:
field MultiPartMessage.HEADERS_FINISHED - removed:
field MultiPartMessage.HEADER_END - removed:
field MultiPartMessage.HEADER_FIELD - removed:
field MultiPartMessage.HEADER_VALUE - removed:
field MultiPartMessage.PART_BEGIN - removed:
field MultiPartMessage.PART_DATA - removed:
field MultiPartMessage.PART_END - changed:
constructor MultiPartParser(headers: Headers, stream: typing.AsyncGenerator[bytes, None]) -> None → constructor MultiPartParser(headers: Headers, stream: typing.AsyncGenerator[bytes, None], *, max_files: typing.Union[int, float]=…, max_fields: typing.Union[int, float]=…) -> None - added:
class MultipartPart - added:
field MultipartPart.content_disposition: typing.Optional[bytes] - added:
field MultipartPart.data: bytes - added:
field MultipartPart.field_name: str - added:
field MultipartPart.file: typing.Optional[UploadFile] - added:
field MultipartPart.item_headers: typing.List[typing.Tuple[bytes, bytes]]
- changed:
method Request.form() -> AwaitableOrContextManager[FormData] → method Request.form(*, max_files: typing.Union[int, float]=…, max_fields: typing.Union[int, float]=…) -> AwaitableOrContextManager[FormData]