GHSA-7wxf-r2qv-9xwr
Docassemble open redirect
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | docassemble.webapp | < 1.4.97 | 1.4.97 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
It is possible to create a URL that acts as an open redirect.
### Patches
The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched.
### Workarounds
If upgrading is not possible, manually apply the changes of [4801ac7](https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa) and restart the server (e.g., by pressing Save on the Configuration screen).
### Credit
The vulnerability was discovered by Riyush Ghimire (@richighimi).
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [docassemble](https://github.com/jhpyle/docassemble/issues)
* Join the [Slack channel](https://join.slack.com/t/docassemble/shared_invite/zt-2cspzjo9j-YyE7SrLmi5muAvnPv~Bz~A)
* Email us at [email protected]
References
External links from the advisory. They lead to third-party sites.