—

PYSEC-2023-7

Quick fix

PYSEC-2023-7 — apache-iotdb: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-iotdb>=0.13.5'

Details

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3.

Attackers could login without authorization. This is fixed in 0.13.4.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-iotdb

Introduced in: 0.13.0Fixed in: 0.13.5

Fixpip install --upgrade 'apache-iotdb>=0.13.5'

References

https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l[ARTICLE]
https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l[ADVISORY]
https://github.com/advisories/GHSA-pvjv-386f-c8wh[ADVISORY]