PyPI/kinto-attachment CVE-2024-1314: high 8.6

Kinto Attachment's attachments can be replaced on read-only records

Action: Upgrade kinto-attachment to 6.4.0 or later.

pip install kinto-attachment==6.4.0

Affected

Fixed versions

Sources

• osv: GHSA-hvp4-vrv2-8wrq
• https://github.com/Kinto/kinto-attachment/security/advisories/GHSA-hvp4-vrv2-8wrq
• https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1
• https://bugzilla.mozilla.org/show_bug.cgi?id=1879034
• https://github.com/Kinto/kinto-attachment

CVE-2024-1314 · published 2024-02-08T18:32:10Z · modified 2026-07-07T17:56:44.775273807Z · JSON