PyPI/graphite-web CVE-2017-18638: unknown, EPSS 15.30%
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server re
Action: Upgrade graphite-web to 1.1.6 or later.
pip install graphite-web==1.1.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.6 | - |
Fixed versions
| 1.1.6 |
Sources
- osv: PYSEC-2019-151
- https://www.youtube.com/watch?v=ds4Gp4xoaeA
- https://github.com/graphite-project/graphite-web/issues/2008
- https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm
- https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf
- https://github.com/graphite-project/graphite-web/pull/2499
- https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html
CVE-2017-18638 · published · modified · JSON