PyPI/graphite-web CVE-2017-18638: high 7.5, EPSS 15.30%

graphite.composer.views.send_email vulnerable to SSRF

Action: Upgrade graphite-web to 1.1.6 or later.

pip install graphite-web==1.1.6

Affected

Fixed versions

Sources

• osv: GHSA-vfj6-275q-4pvm
• https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm
• https://nvd.nist.gov/vuln/detail/CVE-2017-18638
• https://github.com/graphite-project/graphite-web/issues/2008
• https://github.com/graphite-project/graphite-web/pull/2499
• https://github.com/graphite-project/graphite-web/commit/71726a0e41a5263f49b973a7b856505a5b931c1f
• https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf
• https://github.com/graphite-project/graphite-web
• https://github.com/pypa/advisory-database/tree/main/vulns/graphite-web/PYSEC-2019-151.yaml
• https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html
• https://www.youtube.com/watch?v=ds4Gp4xoaeA

CVE-2017-18638 · published 2019-10-25T13:55:20Z · modified 2026-07-08T06:00:25.683795834Z · JSON