Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

kinto-attachment

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6PyPIAmendedPublished

    Kinto Attachment's attachments can be replaced on read-only records

    CVE-2024-1314 · GHSA-hvp4-vrv2-8wrq

    Affected
    • PyPI kinto-attachment <= 6.3.2
    Fixed in
    6.4.0· Vendor fix available
    Issue
    Impact The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent (collection or bucket). And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request. Note that if the parent has no explicit read permission, then the records attachments are safe. Patches - Patch released in kinto-attachment 6.4.0 - https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1 Workarounds None if the read permission has to remain granted. Updating to 6.4.0 or applying the patch individually (if updating is not feasible) is strongly recommended. References - https://bugzilla.mozilla.org/showbug.cgi?id=1879034

    Recommended action: Upgrade to 6.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →