Fix vulnerability critical#740
Conversation
upgrade to werkzeug 2.1.x
peg Flask version to 2.2.4 to bypass breaking change in 2.3.0
update Pipfile.lock to peg Flask dependency
pin PyYAML version, PyPI package
![wiz-4570766290[bot]](https://avatars.githubusercontent.com/u/10251060?s=60&v=4){kind=small}
There was a problem hiding this comment.
More Details
Vulnerabilities [werkzeug:2.3.8]
| Name | Severity | Source | Fixed version | CVSS score | CVSS exploitability score | Has public exploit | Has CISA KEV exploit |
|---|---|---|---|---|---|---|---|
| CVE-2024-34069 |  |
GHSA-2g68-c3qc-8985 | 3.0.3 | 7.5 | 1.6 | true | false |
| CVE-2024-49767 |  |
GHSA-q34m-jh98-gwm2 | 3.0.6 | 6.9 | 3.9 | false | false |
| CVE-2025-66221 | |
GHSA-hgf8-39gv-g3f2 | 3.1.4 | 6.3 | 3.9 | false | false |
| CVE-2026-21860 | |
GHSA-87hc-h4r5-73f7 | 3.1.5 | 6.3 | 3.9 | false | false |
| CVE-2026-27199 | |
GHSA-29vq-49wr-vm6x | 3.1.6 | 6.3 | 3.9 | true | false |
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
| referencing==0.37.0 | ||
| rpds-py==0.30.0 | ||
| six==1.17.0 | ||
| Werkzeug==2.3.8 |
There was a problem hiding this comment.
The following vulnerabilities impact werkzeug versions <3.1.6: CVE-2024-34069, CVE-2024-49767, CVE-2025-66221, CVE-2026-21860, CVE-2026-27199.
These can be remediated by updating to version 3.1.6 or higher.
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
| Werkzeug==2.3.8 | |
| Werkzeug==3.1.6 |
|
Not Required |
3 participants
No description provided.