pysec - pysec-2021-436

pysec-2021-436

Vulnerability from pysec

Published

2021-11-23 20:15

Modified

2021-11-29 23:11

Details

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing ../s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.

Impacted products

Name	purl
matrix-synapse	pkg:pypi/matrix-synapse

Aliases

JSON

To clipboard

{
   affected: [
      {
         package: {
            ecosystem: "PyPI",
            name: "matrix-synapse",
            purl: "pkg:pypi/matrix-synapse",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "91f2bd090",
                  },
               ],
               repo: "https://github.com/matrix-org/synapse",
               type: "GIT",
            },
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "1.47.1",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
         versions: [
            "0.33.5",
            "0.33.5.1",
            "0.33.6",
            "0.33.6rc1",
            "0.33.7",
            "0.33.7rc1",
            "0.33.7rc2",
            "0.33.8",
            "0.33.8rc2",
            "0.33.9",
            "0.34.0",
            "0.34.0.1",
            "0.34.0rc1",
            "0.34.0rc2",
            "0.34.1.1",
            "0.99.0",
            "0.99.0rc1",
            "0.99.0rc2",
            "0.99.0rc3",
            "0.99.0rc4",
            "0.99.1",
            "0.99.1.1",
            "0.99.1rc1",
            "0.99.1rc2",
            "0.99.2",
            "0.99.2rc1",
            "0.99.3",
            "0.99.3.1",
            "0.99.3.2",
            "0.99.3rc1",
            "0.99.4",
            "0.99.4rc1",
            "0.99.5",
            "0.99.5.1",
            "0.99.5.2",
            "0.99.5rc1",
            "1.0.0",
            "1.0.0rc1",
            "1.0.0rc2",
            "1.0.0rc3",
            "1.1.0",
            "1.1.0rc1",
            "1.1.0rc2",
            "1.10.0",
            "1.10.0rc1",
            "1.10.0rc2",
            "1.10.0rc3",
            "1.10.0rc5",
            "1.10.1",
            "1.11.0",
            "1.11.0rc1",
            "1.11.1",
            "1.12.0",
            "1.12.0rc1",
            "1.12.1",
            "1.12.1rc1",
            "1.12.2",
            "1.12.3",
            "1.12.4",
            "1.12.4rc1",
            "1.13.0",
            "1.13.0rc1",
            "1.13.0rc2",
            "1.13.0rc3",
            "1.14.0",
            "1.14.0rc1",
            "1.14.0rc2",
            "1.15.0",
            "1.15.0rc1",
            "1.15.1",
            "1.15.2",
            "1.16.0",
            "1.16.0rc1",
            "1.16.0rc2",
            "1.16.1",
            "1.17.0",
            "1.17.0rc1",
            "1.18.0",
            "1.18.0rc1",
            "1.18.0rc2",
            "1.19.0",
            "1.19.0rc1",
            "1.19.1",
            "1.19.1rc1",
            "1.19.2",
            "1.19.3",
            "1.2.0",
            "1.2.0rc1",
            "1.2.0rc2",
            "1.2.1",
            "1.20.0",
            "1.20.0rc1",
            "1.20.0rc2",
            "1.20.0rc3",
            "1.20.0rc4",
            "1.20.0rc5",
            "1.20.1",
            "1.21.0",
            "1.21.0rc1",
            "1.21.0rc2",
            "1.21.0rc3",
            "1.21.1",
            "1.21.2",
            "1.22.0",
            "1.22.0rc1",
            "1.22.0rc2",
            "1.22.1",
            "1.23.0",
            "1.23.0rc1",
            "1.23.1",
            "1.24.0",
            "1.24.0rc1",
            "1.24.0rc2",
            "1.25.0",
            "1.25.0rc1",
            "1.26.0",
            "1.26.0rc1",
            "1.26.0rc2",
            "1.27.0",
            "1.27.0rc1",
            "1.27.0rc2",
            "1.28.0",
            "1.28.0rc1",
            "1.29.0",
            "1.29.0rc1",
            "1.3.0",
            "1.3.0rc1",
            "1.3.1",
            "1.30.0",
            "1.30.0rc1",
            "1.30.1",
            "1.31.0",
            "1.31.0rc1",
            "1.32.0",
            "1.32.0rc1",
            "1.32.1",
            "1.32.2",
            "1.33.0",
            "1.33.0rc1",
            "1.33.0rc2",
            "1.33.1",
            "1.33.2",
            "1.34.0",
            "1.34.0rc1",
            "1.35.0",
            "1.35.0rc1",
            "1.35.0rc2",
            "1.35.0rc3",
            "1.35.1",
            "1.36.0",
            "1.36.0rc1",
            "1.36.0rc2",
            "1.37.0",
            "1.37.0rc1",
            "1.37.1",
            "1.37.1rc1",
            "1.38.0",
            "1.38.0rc1",
            "1.38.0rc2",
            "1.38.0rc3",
            "1.38.1",
            "1.39.0",
            "1.39.0rc1",
            "1.39.0rc2",
            "1.39.0rc3",
            "1.4.0",
            "1.4.0rc1",
            "1.4.0rc2",
            "1.4.1",
            "1.4.1rc1",
            "1.40.0",
            "1.40.0rc1",
            "1.40.0rc2",
            "1.40.0rc3",
            "1.41.0",
            "1.41.0rc1",
            "1.41.1",
            "1.42.0",
            "1.42.0rc1",
            "1.42.0rc2",
            "1.43.0",
            "1.43.0rc1",
            "1.43.0rc2",
            "1.44.0",
            "1.44.0rc1",
            "1.44.0rc2",
            "1.44.0rc3",
            "1.45.0",
            "1.45.0rc1",
            "1.45.0rc2",
            "1.45.1",
            "1.46.0",
            "1.46.0rc1",
            "1.47.0",
            "1.47.0rc1",
            "1.47.0rc2",
            "1.47.0rc3",
            "1.5.0",
            "1.5.0rc1",
            "1.5.0rc2",
            "1.5.1",
            "1.6.0",
            "1.6.0rc1",
            "1.6.0rc2",
            "1.6.1",
            "1.7.0",
            "1.7.0rc1",
            "1.7.0rc2",
            "1.7.1",
            "1.7.2",
            "1.7.3",
            "1.8.0",
            "1.8.0rc1",
            "1.9.0",
            "1.9.0.dev1",
            "1.9.0.dev2",
            "1.9.0rc1",
            "1.9.1",
         ],
      },
   ],
   aliases: [
      "CVE-2021-41281",
      "GHSA-3hfw-x7gx-437c",
   ],
   details: "Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.",
   id: "PYSEC-2021-436",
   modified: "2021-11-29T23:11:29.870597Z",
   published: "2021-11-23T20:15:00Z",
   references: [
      {
         type: "WEB",
         url: "https://github.com/matrix-org/synapse/releases/tag/v1.47.1",
      },
      {
         type: "ADVISORY",
         url: "https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c",
      },
      {
         type: "FIX",
         url: "https://github.com/matrix-org/synapse/commit/91f2bd090",
      },
   ],
}

ghsa-3hfw-x7gx-437c

Vulnerability from github

Published

2021-11-23 21:58

Modified

2024-09-24 15:47

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

Path traversal in Matrix Synapse

Details

Impact

Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory.

The last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact.

Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected.

Patches

Server administrators should upgrade to 1.47.1 or later.

Workarounds

Server administrators using a reverse proxy could, at the expense of losing media functionality, block the following endpoints:

/_matrix/media/r0/download/{serverName}/{mediaId}
/_matrix/media/r0/download/{serverName}/{mediaId}/{fileName}
/_matrix/media/r0/thumbnail/{serverName}/{mediaId}

Alternatively, non-containerized deployments can be adapted to use the hardened systemd config, located at contrib/systemd/override-hardened.conf.

References

n/a

For more information

If you have any questions or comments about this advisory, e-mail us at security@matrix.org.

Show details on source website

JSON

To clipboard

{
   affected: [
      {
         package: {
            ecosystem: "PyPI",
            name: "matrix-synapse",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "1.47.1",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2021-41281",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-22",
      ],
      github_reviewed: true,
      github_reviewed_at: "2021-11-23T18:44:39Z",
      nvd_published_at: "2021-11-23T20:15:00Z",
      severity: "HIGH",
   },
   details: "### Impact\n\nSynapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory.\n\nThe last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact.\n\nHomeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected.\n\n### Patches\nServer administrators should upgrade to 1.47.1 or later.\n\n### Workarounds\nServer administrators using a reverse proxy could, at the expense of losing media functionality, block the following endpoints:\n\n* `/_matrix/media/r0/download/{serverName}/{mediaId}`\n* `/_matrix/media/r0/download/{serverName}/{mediaId}/{fileName}`\n* `/_matrix/media/r0/thumbnail/{serverName}/{mediaId}`\n\nAlternatively, non-containerized deployments can be adapted to use the hardened systemd config, located at `contrib/systemd/override-hardened.conf`.\n\n### References\nn/a\n\n### For more information\n\nIf you have any questions or comments about this advisory, e-mail us at security@matrix.org.\n",
   id: "GHSA-3hfw-x7gx-437c",
   modified: "2024-09-24T15:47:18Z",
   published: "2021-11-23T21:58:56Z",
   references: [
      {
         type: "WEB",
         url: "https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c",
      },
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2021-41281",
      },
      {
         type: "WEB",
         url: "https://github.com/matrix-org/synapse/commit/91f2bd090",
      },
      {
         type: "PACKAGE",
         url: "https://github.com/matrix-org/synapse",
      },
      {
         type: "WEB",
         url: "https://github.com/matrix-org/synapse/releases/tag/v1.47.1",
      },
      {
         type: "WEB",
         url: "https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-436.yaml",
      },
      {
         type: "WEB",
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS",
      },
      {
         type: "WEB",
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
         type: "CVSS_V3",
      },
      {
         score: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
         type: "CVSS_V4",
      },
   ],
   summary: "Path traversal in Matrix Synapse",
}

cve-2021-41281

Vulnerability from cvelistv5

Published

2021-11-23 19:15

Modified

2024-08-04 03:08

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.

References

▼	URL	Tags
	https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c	x_refsource_CONFIRM
	https://github.com/matrix-org/synapse/commit/91f2bd090	x_refsource_MISC
	https://github.com/matrix-org/synapse/releases/tag/v1.47.1	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS/	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	matrix-org	synapse	Version: < 1.47.1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:08:31.942Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/matrix-org/synapse/commit/91f2bd090",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/matrix-org/synapse/releases/tag/v1.47.1",
               },
               {
                  name: "FEDORA-2021-2f9dcdbace",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2/",
               },
               {
                  name: "FEDORA-2021-9758549fce",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "synapse",
               vendor: "matrix-org",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.47.1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-12-09T02:06:11",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/matrix-org/synapse/commit/91f2bd090",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/matrix-org/synapse/releases/tag/v1.47.1",
            },
            {
               name: "FEDORA-2021-2f9dcdbace",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2/",
            },
            {
               name: "FEDORA-2021-9758549fce",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS/",
            },
         ],
         source: {
            advisory: "GHSA-3hfw-x7gx-437c",
            discovery: "UNKNOWN",
         },
         title: "Path traversal in Matrix Synapse",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-41281",
               STATE: "PUBLIC",
               TITLE: "Path traversal in Matrix Synapse",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "synapse",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.47.1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "matrix-org",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c",
                     refsource: "CONFIRM",
                     url: "https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c",
                  },
                  {
                     name: "https://github.com/matrix-org/synapse/commit/91f2bd090",
                     refsource: "MISC",
                     url: "https://github.com/matrix-org/synapse/commit/91f2bd090",
                  },
                  {
                     name: "https://github.com/matrix-org/synapse/releases/tag/v1.47.1",
                     refsource: "MISC",
                     url: "https://github.com/matrix-org/synapse/releases/tag/v1.47.1",
                  },
                  {
                     name: "FEDORA-2021-2f9dcdbace",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2/",
                  },
                  {
                     name: "FEDORA-2021-9758549fce",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS/",
                  },
               ],
            },
            source: {
               advisory: "GHSA-3hfw-x7gx-437c",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-41281",
      datePublished: "2021-11-23T19:15:18",
      dateReserved: "2021-09-15T00:00:00",
      dateUpdated: "2024-08-04T03:08:31.942Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2021-436

Vulnerability from pysec

ghsa-3hfw-x7gx-437c

Vulnerability from github

Impact

Patches

Workarounds

References

For more information

cve-2021-41281

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature