PyPI/luigi CVE-2018-1000843: high 8.8, EPSS 0.81%

Cross-Site Request Forgery (CSRF) in Luigi

Action: Upgrade luigi to 2.8.0 or later.

pip install luigi==2.8.0

Affected

Fixed versions

Sources

• osv: GHSA-p69g-f978-xxv9
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000843
• https://github.com/spotify/luigi/pull/1870
• https://github.com/advisories/GHSA-p69g-f978-xxv9
• https://github.com/pypa/advisory-database/tree/main/vulns/luigi/PYSEC-2018-11.yaml
• https://github.com/spotify/luigi
• https://github.com/spotify/luigi/blob/2.7.9/luigi/server.py#L67
• https://groups.google.com/forum/#!topic/luigi-user/ZgfRTpBsVUY

CVE-2018-1000843 · published 2018-12-20T22:01:39Z · modified 2024-09-30T17:01:01.119720Z · JSON