FEDORA-2021-917e89c036 created by music 5 days ago for Fedora 34
testing

Security fixes

  • 🔒 Check Content-Type request header before assuming JSON. Initial PR #2118 by @patrickkwang.

This change fixes a CSRF security vulnerability when using cookies for authentication in path operations with JSON payloads sent by browsers.

In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json).

So, a request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted.

But requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.

See CVE-2021-32677 for more details.

Thanks to Dima Boger for the security report! 🙇🔒

Internal

How to install

sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-917e89c036

This update has been submitted for testing by music.

5 days ago

This update's test gating status has been changed to 'ignored'.

5 days ago

This update's test gating status has been changed to 'waiting'.

5 days ago

music edited this update.

5 days ago

This update's test gating status has been changed to 'ignored'.

5 days ago

This update has been pushed to testing.

5 days ago

Please login to add feedback.

Metadata
Type
security
Severity
medium
Karma
0
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-3
Stable by Karma
3
Stable by Time
7 days
Dates
submitted
5 days ago
in testing
5 days ago
days to stable
2
modified
5 days ago
BZ#1969758 python-fastapi-0.65.2 is available
0
0

Automated Test Results