mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-01-27 12:01:38 +01:00
c3deda05a7
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-34069 Upstream-patches:71b69dfb7d890b6b6263Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
45 lines
1.4 KiB
BlitzBasic
45 lines
1.4 KiB
BlitzBasic
SUMMARY = "The Swiss Army knife of Python web development"
|
|
DESCRIPTION = "\
|
|
Werkzeug started as simple collection of various utilities for WSGI \
|
|
applications and has become one of the most advanced WSGI utility modules. \
|
|
It includes a powerful debugger, full featured request and response objects, \
|
|
HTTP utilities to handle entity tags, cache control headers, HTTP dates, \
|
|
cookie handling, file uploads, a powerful URL routing system and a bunch \
|
|
of community contributed addon modules."
|
|
HOMEPAGE = "http://werkzeug.pocoo.org/"
|
|
LICENSE = "BSD-3-Clause"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.rst;md5=5dc88300786f1c214c1e9827a5229462"
|
|
|
|
PYPI_PACKAGE = "Werkzeug"
|
|
|
|
SRC_URI += "file://CVE-2023-25577.patch \
|
|
file://CVE-2023-23934.patch \
|
|
file://CVE-2024-34069-0001.patch \
|
|
file://CVE-2024-34069-0002.patch"
|
|
|
|
SRC_URI[sha256sum] = "f8e89a20aeabbe8a893c24a461d3ee5dad2123b05cc6abd73ceed01d39c3ae74"
|
|
|
|
inherit pypi setuptools3
|
|
|
|
CLEANBROKEN = "1"
|
|
|
|
RDEPENDS:${PN} += " \
|
|
${PYTHON_PN}-datetime \
|
|
${PYTHON_PN}-difflib \
|
|
${PYTHON_PN}-email \
|
|
${PYTHON_PN}-html \
|
|
${PYTHON_PN}-io \
|
|
${PYTHON_PN}-json \
|
|
${PYTHON_PN}-logging \
|
|
${PYTHON_PN}-netclient \
|
|
${PYTHON_PN}-netserver \
|
|
${PYTHON_PN}-numbers \
|
|
${PYTHON_PN}-pkgutil \
|
|
${PYTHON_PN}-pprint \
|
|
${PYTHON_PN}-simplejson \
|
|
${PYTHON_PN}-threading \
|
|
${PYTHON_PN}-unixadmin \
|
|
${PYTHON_PN}-misc \
|
|
${PYTHON_PN}-profile \
|
|
"
|