CVE-2023-47116
2 advisories.
PyPI/label-studio CVE-2023-47116: medium 5.3, EPSS 0.74%
Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections
Action: Upgrade label-studio to 1.11.0 or later.
pip install label-studio==1.11.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.11.0 | - |
Fixed versions
| 1.11.0 |
Sources
- osv: GHSA-p59w-9gqw-wj8r
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-p59w-9gqw-wj8r
- https://nvd.nist.gov/vuln/detail/CVE-2023-47116
- https://github.com/HumanSignal/label-studio/commit/55dd6af4716b92f2bb213fe461d1ffbc380c6a64
- https://en.wikipedia.org/wiki/DNS_rebinding
- https://github.com/HumanSignal/label-studio
- https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/core/utils/io.py#L174-L209
- https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/data_import/uploader.py#L127-L155
- https://github.com/HumanSignal/label-studio/releases/tag/1.11.0
- https://github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2024-127.yaml
CVE-2023-47116 · published · modified · JSON
PyPI/label-studio CVE-2023-47116: medium 5.3, EPSS 0.74%
Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that c
Action: Upgrade label-studio to 1.11.0 or later.
pip install label-studio==1.11.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.11.0 | - |
Fixed versions
| 1.11.0 |
Sources
- osv: PYSEC-2024-127
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-p59w-9gqw-wj8r
- https://github.com/HumanSignal/label-studio/commit/55dd6af4716b92f2bb213fe461d1ffbc380c6a64
- https://github.com/HumanSignal/label-studio/releases/tag/1.11.0
CVE-2023-47116 · published · modified · JSON