id: PYSEC-2021-31
details: OMERO.web is open source Django-based software for managing microscopy imaging.
  OMERO.web before version 5.9.0 loads various information about the current user
  such as their id, name and the groups they are in, and these are available on the
  main webclient pages. This represents an information exposure vulnerability. Some
  additional information being loaded is not used by the webclient and is being removed
  in this release. This is fixed in version 5.9.0.
affected:
- package:
    name: omero-web
    ecosystem: PyPI
    purl: pkg:pypi/omero-web
  ranges:
  - type: GIT
    repo: https://github.com/ome/omero-web
    events:
    - introduced: "0"
    - fixed: 952f8e5d28532fbb14fb665982211329d137908c
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 5.9.0
  versions:
  - 5.5.dev1
  - 5.5.dev2
  - 5.6.dev1
  - 5.6.dev2
  - 5.6.dev3
  - 5.6.dev4
  - 5.6.dev5
  - 5.6.dev6
  - 5.6.dev7
  - 5.6.0
  - 5.6.1
  - 5.6.2
  - 5.6.3
  - 5.7.0
  - 5.7.1
  - 5.8.0
  - 5.8.1
references:
- type: WEB
  url: https://github.com/ome/omero-web/blob/master/CHANGELOG.md#590-march-2021
- type: PACKAGE
  url: https://pypi.org/project/omero-web/
- type: ADVISORY
  url: https://github.com/ome/omero-web/security/advisories/GHSA-gfp2-w5jm-955q
- type: ADVISORY
  url: https://www.openmicroscopy.org/security/advisories/2021-SV1/
- type: FIX
  url: https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb665982211329d137908c
aliases:
- CVE-2021-21376
- GHSA-gfp2-w5jm-955q
modified: "2021-03-27T01:59:00Z"
published: "2021-03-23T16:15:00Z"