PT-2017-10706 · Recurly · Recurly Client Python Library

Published 2017-11-13 · Updated 2019-10-09 · CVE-2017-0906

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Recurly Client Python Library versions prior to 2.0.5 Recurly Client Python Library versions prior to 2.1.16 Recurly Client Python Library versions prior to 2.2.22 Recurly Client Python Library versions prior to 2.3.1 Recurly Client Python Library versions prior to 2.4.5 Recurly Client Python Library versions prior to 2.5.1 Recurly Client Python Library versions prior to 2.6.2

Description The issue is related to a Server-Side Request Forgery vulnerability in the Resource.get method. This could result in the compromise of API keys or other critical resources.

Recommendations For versions prior to 2.0.5, update to version 2.0.5 or later. For versions prior to 2.1.16, update to version 2.1.16 or later. For versions prior to 2.2.22, update to version 2.2.22 or later. For versions prior to 2.3.1, update to version 2.3.1 or later. For versions prior to 2.4.5, update to version 2.4.5 or later. For versions prior to 2.5.1, update to version 2.5.1 or later. For versions prior to 2.6.2, update to version 2.6.2 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2017-0906

GHSA-38RV-5JQC-M2CV

PYSEC-2017-68

Affected Products

Recurly Client Python Library

References · 10

• https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742 · Patch
• https://osv.dev/vulnerability/GHSA-38rv-5jqc-m2cv · Vendor Advisory
• https://dev.recurly.com/page/python-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0906 · Security Note
• https://osv.dev/vulnerability/PYSEC-2017-68 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0906 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/recurly/PYSEC-2017-68.yaml · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0906 · Note
• https://hackerone.com/reports/288635 · Note
• https://github.com/advisories/GHSA-38rv-5jqc-m2cv · Note