基础信息
项目名称：lepture/authlib
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1746646000107294720/1746646000145043456
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| Encode OSS httpx 安全漏洞 | SSRF | MPS-2021-32776 | CVE-2021-41945 | 严重 |
| httpx 存在输入验证不恰当漏洞 | 输入验证不恰当 | MPS-2022-14944 | 中危 | |
| Python 安全漏洞 | ReDoS | MPS-2022-57238 | CVE-2022-40897 | 中危 |
| httpx 存在 SSRF 漏洞 | 输入验证不恰当 | MPS-2022-9102 | 中危 | |
| Requests Proxy-Authorization 标头泄露漏洞 | 未授权敏感信息泄露 | MPS-hr61-tzey | CVE-2023-32681 | 中危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| requests | 2.27.1 | 2.31.0 | 间接依赖 | 建议修复 |
| httpx | 0.18.2 | 间接依赖 | 建议修复 | |
| setuptools | 39.2.0 | 65.5.1 | 间接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| MIT | 3 | 低 |
| BSD-3-Clause | 1 | 低 |
| 自定义许可证 | 5 | 低 |
| Apache-2.0 OR BSD-3-Clause | 1 | 低 |
| Apache-2.0 | 1 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| Column | 间接依赖 | pip | |
| sphinx-copybutton | 0.5.2 | 间接依赖 | pip |
| TestCase | 间接依赖 | pip | |
| ResourceProtector | 间接依赖 | pip | |
| AuthorizationEndpointMixin | 间接依赖 | pip | |
| authlib | 间接依赖 | pip | |
| Response | 间接依赖 | pip | |
| to_unicode | 间接依赖 | pip | |
| BearerTokenValidator | 间接依赖 | pip | |
| Request | 间接依赖 | pip | |
| urlsafe_b64encode | 间接依赖 | pip | |
| get_well_known_url | 间接依赖 | pip | |
| urlparse | 间接依赖 | pip | |
| AESAlgorithm | 间接依赖 | pip | |
| get_bearer_token | 间接依赖 | pip | |
| Flask | 间接依赖 | pip | |
| flask | 间接依赖 | pip | |
| django | 间接依赖 | pip | |
| json_b64encode | 间接依赖 | pip | |
| BaseGrant | 间接依赖 | pip | |
| tests | 间接依赖 | pip | |
| read_file_path | 间接依赖 | pip | |
| quote_url | 间接依赖 | pip | |
| KeySet | 间接依赖 | pip | |
| OAuth2Token | 间接依赖 | pip | |
| db | 间接依赖 | pip | |
| CASCADE | 间接依赖 | pip | |
| jwt | 间接依赖 | pip | |
| DecodeError | 间接依赖 | pip | |
| InvalidClaimError | 间接依赖 | pip | |
| json_loads | 间接依赖 | pip | |
| JsonWebKey | 间接依赖 | pip | |
| OpenIDProviderMetadata | 间接依赖 | pip | |
| User | 间接依赖 | pip | |
| OAuth2Base | 间接依赖 | pip | |
| g | 间接依赖 | pip | |
| TokenCredential | 间接依赖 | pip | |
| CBCHS2EncAlgorithm | 间接依赖 | pip | |
| errors | 间接依赖 | pip | |
| JoseError | 间接依赖 | pip | |
| String | 间接依赖 | pip | |
| livereload | 间接依赖 | pip | |
| cryptography | 间接依赖 | pip | |
| starlette | 间接依赖 | pip | |
| add_params_to_qs | 间接依赖 | pip | |
| to_bytes | 间接依赖 | pip | |
| add_params_to_uri | 间接依赖 | pip | |
| setuptools | 39.2.0 | 间接依赖 | pip |
| werkzeug | 间接依赖 | pip | |
| decode_response | 间接依赖 | pip | |
| USE_CLIENT_DEFAULT | 间接依赖 | pip | |
| httpx | 0.18.2 | 间接依赖 | pip |
| is_openid_scope | 间接依赖 | pip | |
| MissingClaimError | 间接依赖 | pip | |
| sphinx | 6.2.1 | 间接依赖 | pip |
| requests | 2.27.1 | 间接依赖 | pip |
| OAuth1Base | 间接依赖 | pip | |
| validate_nonce | 间接依赖 | pip | |
| sphinx-design | 0.4.1 | 间接依赖 | pip |
| JWEZipAlgorithm | 间接依赖 | pip | |
| urlsafe_b64decode | 间接依赖 | pip | |
| TokenEndpointMixin | 间接依赖 | pip | |
| JsonWebToken | 间接依赖 | pip | |
| mock | 间接依赖 | pip | |
| InsecureClaimError | 间接依赖 | pip | |
| JsonWebEncryption | 间接依赖 | pip | |
| ForeignKey | 间接依赖 | pip | |
| JWTClaims | 间接依赖 | pip | |
| request | 间接依赖 | pip | |
| url_decode | 间接依赖 | pip | |
| grants | 间接依赖 | pip | |
| read_key_file | 间接依赖 | pip | |
| Client | 间接依赖 | pip | |
| Auth | 间接依赖 | pip | |
| data | 间接依赖 | pip |