Package: datasette Version: 0.65.3+ds-1 Severity: grave Tags: upstream security Justification: user security hole X-Debbugs-Cc: Debian Security Team <[email protected]> Control: tags -1 + fixed-upstream pending
datasette 0.65.3+ds-1 (unstable and testing) is affected by upstream advisory GHSA-h547-rmjf-5m2m, table permission bypass via a trailing newline in the table name. CVSS 7.5 (high). No CVE assigned yet. https://github.com/simonw/datasette/security/advisories/GHSA-h547-rmjf-5m2m A request for a table name with a trailing line feed, for example /db/secret~0A/1.json, bypasses the table-level permission check and returns rows from a table the actor is not allowed to read. The identifier check used re.match() with a $ anchor, which also matches before a trailing newline, so the unquoted name reached SQL and SQLite resolved it to the protected table. Reproduced against 0.65.3+ds-1 as installed from unstable. Fixed upstream in 0.65.5. The Debian fix, 0.65.5+ds-1 (urgency=high), is prepared on Salsa and awaiting sponsorship: https://salsa.debian.org/python-team/packages/datasette That upload also brings in upstream 0.65.4, which has no advisory of its own but hardens the same area: case-insensitive table permission checks, permission checks on intermediate tables used by through filters, SQL identifier escaping in row queries and pagination, and Cache-Control on private responses. datasette has never shipped in a stable release (first upload December 2025), so only unstable and testing are affected and no backport is needed. -- System Information: Debian Release: 13.7 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 7.1.8+deb13-amd64 (SMP w/12 CPU threads; PREEMPT) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
