—
PYSEC-2021-128
Quick fix
PYSEC-2021-128 — apache-superset: upgrade to the fixed version with the command below.
pip install --upgrade 'apache-superset>=1.1.0'Details
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/apache-superset
Introduced in:
0Fixed in: 1.1.0Fix
pip install --upgrade 'apache-superset>=1.1.0'References
- https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E[WEB]
- https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E[WEB]
- http://www.openwall.com/lists/oss-security/2021/04/27/2[WEB]
- https://github.com/advisories/GHSA-pfwg-rxf4-97c3[ADVISORY]