Debian alert DLA-4197-1 (python-flask-cors)

From:
             
 
Daniel Leidert <daniel.leidert@wgdd.de>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4197-1] python-flask-cors security update
Date:
             
 
Sat, 31 May 2025 04:30:08 +0200
Message-ID:
             
 
<efd624174e3cff197140ba89eb0fac2ec1da35ba.camel@wgdd.de>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4197-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Daniel Leidert
May 31, 2025                                  https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : python-flask-cors
Version        : 3.0.9-2+deb11u1
CVE ID         : CVE-2024-1681 CVE-2024-6839 CVE-2024-6844 CVE-2024-6866
Debian Bug     : 1069764 1100988

Multiple security issues were discovered in Flask-CORS, a Flask
extension for handling Cross Origin Resource Sharing (CORS).

CVE-2024-1681

   Due to a log injection vulnerability when the log level is set to
   debug, an attacker can inject fake log entries into the log file by
   sending a specially crafted GET request containing a CRLF sequence
   in the request path.

CVE-2024-6839

   An improper regex path matching vulnerability due to prioritizing
   longer regex patterns over more specific ones when matching paths,
   can lead to less restrictive CORS policies being applied to
   sensitive endpoints. 

CVE-2024-6844

   An inconsistent CORS matching due to the handling of the '+'
   character in URL paths leads to incorrect path normalization,
   causing potential mismatches in CORS configuration.

CVE-2024-6866

   The request path matching is case-insensitive. This results in a
   mismatch because paths in URLs are case-sensitive. This
   misconfiguration can lead to significant security vulnerabilities,
   allowing unauthorized origins to access paths meant to be
   restricted.

For Debian 11 bullseye, these problems have been fixed in version
3.0.9-2+deb11u1.

We recommend that you upgrade your python-flask-cors packages.

For the detailed security status of python-flask-cors please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-flask-cors

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQJLBAABCgA1FiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmg6abAXHGRhbmllbC5s
ZWlkZXJ0QHdnZGQuZGUACgkQS80FZ8KW0F2KSA/9H02jBAIEkWSxG57JKfQsgyfX
ceGFWnLq9Ty70PCQeYbLE5P1nmwBbpPPGp/tW1oWrzilMIdW6ejAO+ctOXd1sybM
UcpS/2gZRkdrL5VWAw2ee3yML2qTXBFRVvTNt1DBNgMT8qX/I17GHJztoOJt0KYI
A/WWeVU4qx8KhLYPyEBFs8LxSYMip5G9vjXSHcQtr+f41qNqle0Esmcfkve5wTHf
GOJWZgT1C37LnhYXoszja0cqlerPe08wb4QMmGn06fGkkBmLQVxZhfcz9I2urn/h
VGvM2S9nits9ypXbWAV5cUg/iMI2iA08TYnvilCMn89XhpmEb/XHvqKyoFc/N4df
y65j//3ycXcy9FeCQ81RqRgyvyG2bfSKguovG33NIqJfukZa764lH457JG26IW3N
aFk7Sde+ynVdb9vsc7SC0wzAOTodGlDlrHgzGsjfAWBkxW7mHrcIBBNtCNOc2hp+
ciqwsq59Rx0ingtid7P4YmN1UrDV88IN0SuXgjCQeRmGwEdo3ALAqGnQlwQtaTzn
kKr5UuLl7rCwYvlz+UvTpkuEhV9YUWo/WKr537TEO4z4d6X6I59eqx73lw5705aa
mQ8ysy7HE/Qelou9h4R3u/yTcYDIpGKtwRm+xl1SorRwebpxRApOnVs9+yR+VxEX
QPbkSB9tB/BJH9YOnJ8=
=j0XA
-----END PGP SIGNATURE-----