langchain-0.1.9-py3-none-any.whl: 3 vulnerabilities (highest severity is: 8.1)

[mend-for-github-com]

Vulnerable Library - langchain-0.1.9-py3-none-any.whl

Building applications with LLMs through composability

Library home page: https://files.pythonhosted.org/packages/45/05/2d5c38c7fa1a091a61e018070b6878410d256be577e5154843d339e59b2c/langchain-0.1.9-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 63db09d57db04dc09ffd3c6460290a5cd1cc6c8c

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (langchain version)	Remediation Possible**	Reachability
CVE-2024-28088	High	8.1	langchain-0.1.9-py3-none-any.whl	Direct	0.1.12	✅
CVE-2024-2057	Medium	6.3	langchain-0.1.9-py3-none-any.whl	Direct	0.1.12	✅
CVE-2024-2965	Medium	4.2	langchain-0.1.9-py3-none-any.whl	Direct	0.2.5	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-28088

Vulnerable Library - langchain-0.1.9-py3-none-any.whl

Building applications with LLMs through composability

Library home page: https://files.pythonhosted.org/packages/45/05/2d5c38c7fa1a091a61e018070b6878410d256be577e5154843d339e59b2c/langchain-0.1.9-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ langchain-0.1.9-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 63db09d57db04dc09ffd3c6460290a5cd1cc6c8c

Found in base branch: main

Vulnerability Details

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution. (A patch is available as of release 0.1.29 of langchain-core.)

Publish Date: 2024-03-03

URL: CVE-2024-28088

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-03-03

Fix Resolution: 0.1.12

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-2057

Vulnerable Library - langchain-0.1.9-py3-none-any.whl

Building applications with LLMs through composability

Library home page: https://files.pythonhosted.org/packages/45/05/2d5c38c7fa1a091a61e018070b6878410d256be577e5154843d339e59b2c/langchain-0.1.9-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ langchain-0.1.9-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 63db09d57db04dc09ffd3c6460290a5cd1cc6c8c

Found in base branch: main

Vulnerability Details

A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372.

Publish Date: 2024-03-01

URL: CVE-2024-2057

CVSS 3 Score Details (6.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-03-01

Fix Resolution: 0.1.12

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-2965

Vulnerable Library - langchain-0.1.9-py3-none-any.whl

Building applications with LLMs through composability

Library home page: https://files.pythonhosted.org/packages/45/05/2d5c38c7fa1a091a61e018070b6878410d256be577e5154843d339e59b2c/langchain-0.1.9-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ langchain-0.1.9-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 63db09d57db04dc09ffd3c6460290a5cd1cc6c8c

Found in base branch: main

Vulnerability Details

A Denial-of-Service (DoS) vulnerability exists in the SitemapLoader class of the langchain-ai/langchain repository, affecting all versions. The parse_sitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.

Publish Date: 2024-06-06

URL: CVE-2024-2965

CVSS 3 Score Details (4.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Physical
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3hjh-jh2h-vrg6

Release Date: 2024-06-06

Fix Resolution: 0.2.5

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.