Fixed improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below (CVE-2022-29361). Fixes #7602

docs/en_US/release_notes_6_13.rst

@@ -23,6 +23,7 @@ Housekeeping
   | `Issue #7568 <https://redmine.postgresql.org/issues/7568>`_ -  Port change user password and 2FA dialog to React.
   | `Issue #7590 <https://redmine.postgresql.org/issues/7590>`_ -  Port change ownership dialog to React.
   | `Issue #7595 <https://redmine.postgresql.org/issues/7595>`_ -  Update the container base image to Alpine 3.16 (with Python 3.10.5).
+  | `Issue #7602 <https://redmine.postgresql.org/issues/7602>`_ -  Fixed improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below (CVE-2022-29361).
 
 Bug fixes
 *********

requirements.txt

@@ -49,7 +49,7 @@ Pillow==9.*; python_version >= '3.7'
 boto3==1.20.*
 botocore==1.23.*
 urllib3==1.26.*
-Werkzeug==2.0.3
+Werkzeug==2.1.1
 azure-mgmt-rdbms==10.1.0
 azure-mgmt-resource==21.0.0
 azure-mgmt-subscription==3.0.0

web/pgadmin/tools/debugger/__init__.py

@@ -17,7 +17,7 @@ import copy
 from flask import render_template, request, current_app
 from flask_babel import gettext
 from flask_security import login_required
-from werkzeug.useragents import UserAgent
+from werkzeug.user_agent import UserAgent
 
 from pgadmin.utils import PgAdminModule, \
     SHORTCUT_FIELDS as shortcut_fields, \

web/pgadmin/tools/erd/__init__.py

@@ -14,7 +14,7 @@ from flask import url_for, request
 from flask import render_template, current_app as app
 from flask_security import login_required
 from flask_babel import gettext
-from werkzeug.useragents import UserAgent
+from werkzeug.user_agent import UserAgent
 from pgadmin.utils import PgAdminModule, \
     SHORTCUT_FIELDS as shortcut_fields
 from pgadmin.utils.ajax import make_json_response, bad_request, \