CVE-2017-0906

Advisory

The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.


MISC:https://hackerone.com/reports/288635: https://hackerone.com/reports/288635
CONFIRM:https://dev.recurly.com/page/python-updates: https://dev.recurly.com/page/python-updates
CONFIRM:https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742: https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0906
• https://hackerone.com/reports/288635
• https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742
• https://dev.recurly.com/page/python-updates