streamlit-1.16.0-py2.py3-none-any.whl: 1 vulnerabilities (highest severity is: 6.5)

[mend-bolt-for-github]

Vulnerable Library - streamlit-1.16.0-py2.py3-none-any.whl

A faster way to build and share data apps

Library home page: https://files.pythonhosted.org/packages/53/cc/5ff6ac10c9f84aa2ee7fb8c2f58694dbbe1c12cd3e5a3e23cf4659e2fd4d/streamlit-1.16.0-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 49939a7d3bf790c17e5165de2c4265f0082cc165

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (streamlit version)	Remediation Possible**
CVE-2024-42474	Medium	6.5	streamlit-1.16.0-py2.py3-none-any.whl	Direct	1.37.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-42474

Vulnerable Library - streamlit-1.16.0-py2.py3-none-any.whl

A faster way to build and share data apps

Library home page: https://files.pythonhosted.org/packages/53/cc/5ff6ac10c9f84aa2ee7fb8c2f58694dbbe1c12cd3e5a3e23cf4659e2fd4d/streamlit-1.16.0-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ streamlit-1.16.0-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 49939a7d3bf790c17e5165de2c4265f0082cc165

Found in base branch: main

Vulnerability Details

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.

Publish Date: 2024-08-12

URL: CVE-2024-42474

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rxff-vr5r-8cj5

Release Date: 2024-08-12

Fix Resolution: 1.37.0

Step up your Open Source Security Game with Mend here