Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Recommended action: Upgrade to 0.9.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to (1) remotestorage.py, (2) storage.py, (3) render/datalib.py, and (4) whitelist/views.py, a different vulnerability than CVE-2013-5093.
Recommended action: Upgrade to 0.9.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact sendemail in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. Email will be send through SMTP server configured in Graphite, by default it's 'localhost' Patches Problem was patched in Graphite-web 1.1.6. Also patches was released for graphite-web 1.0.x and 0.9.x, and we'll discuss releases of non-supported branches later. Workarounds You can manually remove function sendemail from file webapp/graphite/composer/views.py. This function are not in use and will not affect your Graphite installation. References For more information check this graphite-web Github issue #2008 For more information If you have any questions or comments about this…
Recommended action: Upgrade to 1.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 0.9.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.