prefect 2.2.0 vulnerabilities

Known vulnerabilities in the prefect package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
H Origin Validation Error prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest. Affected versions of this package are vulnerable to Origin Validation Error due to a misconfiguration in the handling of CORS policies. An attacker can access sensitive data and potentially disrupt services by sending requests from unauthorized domains. How to fix Origin Validation Error? Upgrade `prefect` to version 2.20.17, 3.0.3 or higher.	[,2.20.17)[3.0.0,3.0.3)
H Server-side Request Forgery (SSRF) prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest. Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) when Prefect API is exposed to "external" users of any kind. An attacker can maliciously craft a notification URL that points to an internal API, resulting in potential information exposure, access to internal services, and private IP addresses. How to fix Server-side Request Forgery (SSRF)? Upgrade `prefect` to version 2.20.11, 3.0.2 or higher.	[,2.20.11)[3.0.0rc1,3.0.2)
M Regular Expression Denial of Service (ReDoS) prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the `python-multipart`. Note: When trying to install the latest `FastAPI`, which depends on `starlette` library, `prefect` library cannot be installed due to version compatibility. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `prefect` to version 2.15.0 or higher.	[,2.15.0)
H Cross-site Request Forgery (CSRF) prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to improper authentication. An attacker can potentially gain remote code execution, steal and alter secrets. How to fix Cross-site Request Forgery (CSRF)? Upgrade `prefect` to version 2.16.5 or higher.	[,2.16.5)
M Information Exposure prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest. Affected versions of this package are vulnerable to Information Exposure. The vulnerability allows for the unintended exposure of sensitive information related to function argument names when an error occurs during parameter binding for a function. How to fix Information Exposure? Upgrade `prefect` to version 2.11.1 or higher.	[,2.11.1)

Vulnerability

Vulnerable Version

Origin Validation Error

prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest.

Affected versions of this package are vulnerable to Origin Validation Error due to a misconfiguration in the handling of CORS policies. An attacker can access sensitive data and potentially disrupt services by sending requests from unauthorized domains.

How to fix Origin Validation Error?

Upgrade prefect to version 2.20.17, 3.0.3 or higher.

[,2.20.17)[3.0.0,3.0.3)

Server-side Request Forgery (SSRF)

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) when Prefect API is exposed to "external" users of any kind. An attacker can maliciously craft a notification URL that points to an internal API, resulting in potential information exposure, access to internal services, and private IP addresses.

How to fix Server-side Request Forgery (SSRF)?

Upgrade prefect to version 2.20.11, 3.0.2 or higher.

[,2.20.11)[3.0.0rc1,3.0.2)

Regular Expression Denial of Service (ReDoS)

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the python-multipart.

Note: When trying to install the latest FastAPI, which depends on starlette library, prefect library cannot be installed due to version compatibility.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade prefect to version 2.15.0 or higher.

[,2.15.0)

Cross-site Request Forgery (CSRF)

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to improper authentication. An attacker can potentially gain remote code execution, steal and alter secrets.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade prefect to version 2.16.5 or higher.

[,2.16.5)

Information Exposure

Affected versions of this package are vulnerable to Information Exposure. The vulnerability allows for the unintended exposure of sensitive information related to function argument names when an error occurs during parameter binding for a function.

How to fix Information Exposure?

Upgrade prefect to version 2.11.1 or higher.

[,2.11.1)

prefect@2.2.0 vulnerabilities

Workflow orchestration and management.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?