—

PYSEC-2020-240

Quick fix

PYSEC-2020-240 — mistral: upgrade to the fixed version with the command below.

pip install --upgrade 'mistral>=7.0.4'

Details

A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/mistral

Introduced in: 0Fixed in: 7.0.4

Fixpip install --upgrade 'mistral>=7.0.4'

References

https://bugzilla.redhat.com/show_bug.cgi?id=1645332[REPORT]
https://bugs.launchpad.net/mistral/+bug/1785657[WEB]
https://github.com/advisories/GHSA-443j-6p7g-6v4w[ADVISORY]