critical9.8
CVE-2017-0906
Recurly vulnerable to SSRF
Impact
The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource.get` method that could result in compromise of API keys or other critical resources.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | recurly | >= 2.6.0, < 2.6.2 | 2.6.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Recurly | Recurly Client Python | from 2.0.0 through 2.0.4 from 2.1.0 through 2.1.15 from 2.2.0 through 2.2.21 from 2.4.0 through 2.4.4 Versions 2.3.0, 2.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://dev.recurly.com/page/python-updates
- https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742
- https://hackerone.com/reports/288635
- https://github.com/advisories/GHSA-38rv-5jqc-m2cv
- https://nvd.nist.gov/vuln/detail/CVE-2017-0906
- https://github.com/pypa/advisory-database/tree/main/vulns/recurly/PYSEC-2017-68.yaml