PyPI/datasette CVE-2023-40570: medium 5.3, EPSS 0.56%
Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users
Action: Upgrade datasette to 1.0a4 or later.
pip install datasette==1.0a4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0a0 | 1.0a4 | - |
Fixed versions
| 1.0a4 |
Sources
- osv: GHSA-7ch3-7pp7-7cpq
- https://github.com/simonw/datasette/security/advisories/GHSA-7ch3-7pp7-7cpq
- https://nvd.nist.gov/vuln/detail/CVE-2023-40570
- https://github.com/simonw/datasette/commit/01e0558825b8f7ec17d3b691aa072daf122fcc74
- https://github.com/pypa/advisory-database/tree/main/vulns/datasette/PYSEC-2023-154.yaml
- https://github.com/simonw/datasette
CVE-2023-40570 · published · modified · JSON