diff --git a/package-lock.json b/package-lock.json index 5d0bf62..68ec98a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -17,7 +17,7 @@ "hexo-renderer-marked": "^6.0.0", "hexo-renderer-stylus": "^3.0.0", "hexo-server": "^3.0.0", - "hexo-theme-next": "^8.19.2" + "hexo-theme-next": "^8.20.0" } }, "node_modules/@adobe/css-tools": { @@ -535,9 +535,9 @@ } }, "node_modules/dompurify": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.1.0.tgz", - "integrity": "sha512-yoU4rhgPKCo+p5UrWWWNKiIq+ToGqmVVhk0PmMYBK4kRsR3/qhemNFL8f6CFmBd4gMwm3F4T7HBoydP5uY07fA==" + "version": "3.1.2", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.1.2.tgz", + "integrity": "sha512-hLGGBI1tw5N8qTELr3blKjAML/LY4ANxksbS612UiJyDfyf/2D092Pvm+S7pmeTGJRqvlJkFzBoHBQKgQlOQVg==" }, "node_modules/domutils": { "version": "3.1.0", @@ -1031,9 +1031,9 @@ } }, "node_modules/hexo-theme-next": { - "version": "8.19.2", - "resolved": "https://registry.npmjs.org/hexo-theme-next/-/hexo-theme-next-8.19.2.tgz", - "integrity": "sha512-FyDbKvVRJKT+3yYxkfsXBVXHHPGxNULYfdd+pavcSclonehNwlpq7oPMsTPfO5jaYFuSmNH68TFTqRuXNZ2bHw==" + "version": "8.20.0", + "resolved": "https://registry.npmjs.org/hexo-theme-next/-/hexo-theme-next-8.20.0.tgz", + "integrity": "sha512-cLKE32mP6B2E84+4XUXOgZhaI+srndHAviVpDaz8S7fj4OTnRchWg1anbhpZTFAgMO0NSRs4A0kT61eXY3l/Gg==" }, "node_modules/hexo-util": { "version": "3.3.0", @@ -1590,9 +1590,9 @@ } }, "node_modules/nwsapi": { - "version": "2.2.8", - "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.8.tgz", - "integrity": "sha512-GU/I3lTEFQ9mkEm07Q7HvdRajss8E1wVMGOk3/lHl60QPseG+B3BIQY+JUjYWw7gF8cCeoQCXd4N7DB7avw0Rg==" + "version": "2.2.9", + "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.9.tgz", + "integrity": "sha512-2f3F0SEEer8bBu0dsNCFF50N0cTThV1nWFYcEYFZttdW0lDAoybv9cQoK7X7/68Z89S7FoRrVjP1LPX4XRf9vg==" }, "node_modules/on-finished": { "version": "2.3.0", @@ -2113,9 +2113,9 @@ } }, "node_modules/tough-cookie": { - "version": "4.1.3", - "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.3.tgz", - "integrity": "sha512-aX/y5pVRkfRnfmuX+OdbSdXvPe6ieKX/G2s7e98f4poJHnqH3281gDPm/metm6E/WRamfx7WC4HUqkWHfQHprw==", + "version": "4.1.4", + "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.4.tgz", + "integrity": "sha512-Loo5UUvLD9ScZ6jh8beX1T6sO1w2/MpCRpEP7V280GKMVUQ0Jzar2U3UJPsrdbziLEMMhu3Ujnq//rhiFuIeag==", "dependencies": { "psl": "^1.1.33", "punycode": "^2.1.1", @@ -2276,9 +2276,9 @@ "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==" }, "node_modules/ws": { - "version": "8.16.0", - "resolved": "https://registry.npmjs.org/ws/-/ws-8.16.0.tgz", - "integrity": "sha512-HS0c//TP7Ina87TfiPUz1rQzMhHrl/SG2guqRcTOIUYD2q8uhUdNHZYJUaQ8aTGPzCh+c6oawMKW35nFl1dxyQ==", + "version": "8.17.0", + "resolved": "https://registry.npmjs.org/ws/-/ws-8.17.0.tgz", + "integrity": "sha512-uJq6108EgZMAl20KagGkzCKfMEjxmKvZHG7Tlq0Z6nOky7YF7aq4mOx6xK8TJ/i1LeK4Qus7INktacctDgY8Ow==", "engines": { "node": ">=10.0.0" }, diff --git a/package.json b/package.json index a00c11b..8d21ac9 100644 --- a/package.json +++ b/package.json @@ -21,6 +21,6 @@ "hexo-renderer-marked": "^6.0.0", "hexo-renderer-stylus": "^3.0.0", "hexo-server": "^3.0.0", - "hexo-theme-next": "^8.19.2" + "hexo-theme-next": "^8.20.0" } } diff --git a/source/_posts/Patch-Gunicorn-to-version-22-0-to-prevent-HTTP-Request-Smuggling-vulnerability.md b/source/_posts/Patch-Gunicorn-to-version-22-0-to-prevent-HTTP-Request-Smuggling-vulnerability.md index f8b2ee6..9cd321f 100644 --- a/source/_posts/Patch-Gunicorn-to-version-22-0-to-prevent-HTTP-Request-Smuggling-vulnerability.md +++ b/source/_posts/Patch-Gunicorn-to-version-22-0-to-prevent-HTTP-Request-Smuggling-vulnerability.md @@ -11,7 +11,7 @@ tags: --- ## Which version(s) are affected? -Hey fellow readers, if you're deploying your python application or containerized application through Gunicorn (Green Unicorn) there is a new vulnerability that bypasses validation when == multiple conflicting Transfer-Encoding headers == are used which are treated as chunked data regardlesss of final encoding leading to Request Smuggling allowing access to restricted API endpoints in your application without needed credentials/tokens. +Hey fellow readers, if you\'re deploying your python application or containerized application through Gunicorn (Green Unicorn) there is a new vulnerability that bypasses validation when **multiple conflicting Transfer-Encoding headers** are used which are treated as chunked data regardless of final encoding leading to Request Smuggling allowing access to restricted API endpoints in your application without needed credentials/tokens. The new update version 22.0 fixes the issue mentioned in the [commit](https://github.com/benoitc/gunicorn/commit/ac29c9b0a758d21f1e0fb3b3457239e523fa9f1d).