Workshop Green LLM Usage

Certifi removes GLOBALTRUST root certificate

Starlette has possible denial-of-service vector when parsing large files in multipart forms

urllib3 streaming API improperly handles highly compressed data

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

urllib3 does not control redirects in browsers and Node.js

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Vulnerable OpenSSL included in cryptography wheels

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Tornado has incomplete validation of cookie attributes

Vulnerable OpenSSL included in cryptography wheels

Tornado vulnerable to excessive logging caused by malformed multipart form data

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Requests vulnerable to .netrc credentials leak via malicious URLs

Requests `Session` object does not verify requests after making first request with verify=False

Tornado has out-of-bounds memory access via C extension

Starlette Denial of service (DoS) via multipart/form-data

JWCrypto: JWE ZIP decompression bomb

tqdm CLI arguments injection attack

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

urllib3 allows an unbounded number of links in the decompression chain

pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

cryptography has incomplete DNS name constraint enforcement on peer names

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

Tornado is vulnerable to DoS due to too many multipart parts

cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

h11 accepts some malformed Chunked-Encoding bodies

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

Not reported

Not reported

Not reported

Not reported