id: PYSEC-2023-187
modified: 2023-10-02T22:26:51.461030Z
published: 2023-10-02T20:15:00Z
aliases:
- CVE-2023-44463
- GHSA-j9gq-w73w-9h6c
details: An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration
  files causes the application to trust unchecked X-Forwarded-For headers even though
  it has not been configured to do so. This can lead to IP address spoofing by users
  of the application.
affected:
- package:
    ecosystem: PyPI
    name: pretix
    purl: pkg:pypi/pretix
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: ccdce2ccb8207b82501af3c03f50abc0f819b469
    repo: https://github.com/pretix/pretix
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2023.7.1
  versions:
  - 1.0.0
  - 1.0.0b1
  - 1.0.0b2
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.10.0
  - 1.10.1
  - 1.11.0
  - 1.11.1
  - 1.12.0
  - 1.12.1
  - 1.13.0
  - 1.13.1
  - 1.14.0
  - 1.15.0
  - 1.15.1
  - 1.15.2
  - 1.16.0
  - 1.17.0
  - 1.17.1
  - 1.2.0
  - 1.2.1.post2
  - 1.2.2
  - 1.3.0
  - 1.3.0.post1
  - 1.3.1
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.5.2
  - 1.6.0
  - 1.6.1
  - 1.6.2
  - 1.7.1
  - 1.7.2
  - 1.8.0
  - 1.8.1
  - 1.9.0
  - 1.9.1
  - 2.0.0
  - 2.1.0
  - 2.2.0
  - 2.3.0
  - 2.4.0
  - 2.5.0
  - 2.6.0
  - 2.7.0
  - 2.7.1
  - 2.7.2
  - 2.8.2
  - 2023.6.0
  - 2023.6.1
  - 2023.6.3
  - 2023.7.0
  - 3.0.0
  - 3.0.1
  - 3.1.0
  - 3.10.0
  - 3.11.0
  - 3.11.1
  - 3.12.0
  - 3.12.1
  - 3.13.0
  - 3.13.1
  - 3.14.0
  - 3.14.1
  - 3.14.2
  - 3.15.0
  - 3.16.0
  - 3.17.1
  - 3.17.2
  - 3.18.0
  - 3.2.0
  - 3.3.0
  - 3.4.0
  - 3.5.0
  - 3.6.0
  - 3.6.0.post1
  - 3.7.0
  - 3.8.0
  - 3.9.0
  - 4.0.0
  - 4.1.0
  - 4.10.0
  - 4.10.1
  - 4.11.0
  - 4.11.1
  - 4.12.0
  - 4.13.0
  - 4.13.1
  - 4.14.0
  - 4.14.0.dev0
  - 4.15.0
  - 4.15.0.dev0
  - 4.15.1
  - 4.16.0
  - 4.16.1
  - 4.17.0
  - 4.17.1
  - 4.18.0
  - 4.18.1
  - 4.18.2
  - 4.18.2.post1
  - 4.19.0
  - 4.2.0
  - 4.20.0
  - 4.20.1
  - 4.20.2.post1
  - 4.20.4
  - 4.3.0
  - 4.3.1
  - 4.4.0
  - 4.4.1
  - 4.5.0
  - 4.5.1
  - 4.5.2
  - 4.6.0
  - 4.6.1
  - 4.7.0
  - 4.7.1
  - 4.8.0
  - 4.9.0
  - 4.9.1
references:
- type: WEB
  url: https://github.com/pretix/pretix/tags
- type: WEB
  url: https://github.com/pretix/pretix/compare/v2023.7.0...v2023.7.1
- type: WEB
  url: https://pretix.eu/about/en/ticketing
- type: FIX
  url: https://github.com/pretix/pretix/commit/ccdce2ccb8207b82501af3c03f50abc0f819b469
- type: ARTICLE
  url: https://pretix.eu/about/en/blog/20230911-release-2023-7-1/
- type: ADVISORY
  url: https://github.com/advisories/GHSA-j9gq-w73w-9h6c