Two critical Security Issues
Nobody has claimed this yet.
- Dominant language
- Dockerfile
- Stars
- 1.2k
- Forks
- 1.7k
- PR merge metrics
- No merged PRs in 30d
Description
Following the docker documentation, the official odoo docker image has two critical issues:
CVE-2022-29361: Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project
CVE-2023-41419: An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.
I think both can be fixed by updating the effected software within the docker container.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the official Odoo Docker image build referenced by the Docker documentation and trace where its Python dependencies are selected. The issue names no file or test; done means updating the affected software so the resulting image no longer contains CVE-2022-29361 or CVE-2023-41419.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100