[GHSA-83pv-qr33-2vcf] Litestar and Starlite vulnerable to Path Traversal

[JacobCoffee]

Updates

• Affected products

Comments
Add Starlite (v1) fix version

[github]

Hi there @brian-edgar-re and @peterschutt! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[JacobCoffee]

Suggested change

	"last_known_affected_version_range": "<= 1.51.14"
	"last_known_affected_version_range": "<= 1.51.15"

[CallmeMari]

Hi @JacobCoffee do you have any references for the addition of the starlite package?

[brian-edgar-re]

Hi @CallmeMari , seems @JacobCoffee wasn't able to see your message. By my side, I think he added that additional version because it wasn't included the fix in the expected version (1.51.15). https://github.com/litestar-org/litestar/releases/tag/v1.51.16

[peterschutt]

Hi @CallmeMari , seems @JacobCoffee wasn't able to see your message. By my side, I think he added that additional version because it wasn't included the fix in the expected version (1.51.15). https://github.com/litestar-org/litestar/releases/tag/v1.51.16

We released 1.51.15 before the patch was applied in order to test that our release pipeline for the 1.x series was still in good shape, it had been a while since we'd had to cut a release for that version. Patch subsequently released in 1.51.16.