Safety vulnerability ID: 37311
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Invenio-app 1.1.1 fixes a security issue where APP_ALLOWED_HOSTS was not always being checked, and thus could allow host header injection attacks.
Latest version: 2.0.0
WSGI, Celery and CLI applications for Invenio flavours.
- Fixes a security issue where APP_ALLOWED_HOSTS was not always being checked,
and thus could allow host header injection attacks.
NOTE: you should never route requests to your application with a wrong host
header. The APP_ALLOWED_HOSTS exists as an extra protective measure, because
it is easy to misconfigure your web server.
The root cause was that Werkzeug's trusted host feature only works when
request.host is being evaluated. This means that for instance when only
url_for (part of the routing system) is used, then the host header check is
not performed.
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application