Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default (unless explicitly defined in configuration by a new allowinternalrequests directive. The commit/fix can be found in 3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef. Workarounds Users can update existing applications by disabling process based resources in their pygeoapi config, until 0.23.3 can be installed and deployed.
Recommended action: Upgrade to 0.23.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with .. values, along with a resource of type stac-collection defined in configuration. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The commit/fix can be found in bf25b8695edbdd5476eeffc102b633d1d3e45f52. Workarounds Users can safeguard existing applications by disabling STAC collection based resources in their pygeoapi config, until 0.23.3 can be installed and deployed.
Recommended action: Upgrade to 0.23.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.