Debian alert DLA-4605-1 (python-flask-httpauth)

From:
             
 
Emmanuel Arias <eamanu@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4605-1] python-flask-httpauth security update
Date:
             
 
Thu, 28 May 2026 13:05:28 -0300
Message-ID:
             
 
<ahhnyNBnyB8wFxiR@debian>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4605-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Emmanuel Arias
May 28, 2026                                  https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : python-flask-httpauth
Version        : 3.2.4-3.1+deb11u1
CVE ID         : CVE-2026-34531
Debian Bug     : 1132581

A vulnerability was found in python-flask-httpauth, a Flask extension that
simplifies the use of HTTP authentication with Flask routes, that in a situation
where the client makes a request to a token protected resource without passing a
token, or passing an empty token, python-flask-httpauth would invoke the
application's token verification callback function with the token argument set
to an empty string. If the application had any users in its database with an
empty string set as their token, then it could potentially authenticate the
client request against any of those users.

For Debian 11 bullseye, this problem has been fixed in version
3.2.4-3.1+deb11u1.

We recommend that you upgrade your python-flask-httpauth packages.

For the detailed security status of python-flask-httpauth please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-flask-...

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEE3lnVbvHK7ir4q61+p3sXeEcY/EFAmoYZ8cACgkQ+p3sXeEc
Y/ELaA//b2CjjLA5eKLDhd2d02qaq2khTbUUWzSZ6FQlwTSAHhSZEp8pBCybiG7S
W3pBZ3zV2budzouPXvvx1Ab6kCDv8z2ypYIesccqdCiBOpuRX5EiRlGALA/s5sY1
F4QbHvPQKA95jPiUo2hYxDQgfcqhZi9OY4xgG/tJsF5YPYqgknHlgabriFyESdU6
U31tgBfHthEm8yTRBLfMlOtC5fmxCDqmCVp2UP+l0kQDC3KKKRO5OT7qZDhIE864
kyKP3RUDZ+X21eFBiQIhkI4XWylLS0XQKIjdVlH5hn+czIRmP8NUtTp7N+a9zGZo
NR3BLKM0XxTH0AkAjrmX6JNUsCO4MfJ84g9WI+PLi8wBTP/5PjX628+Vm27COQm+
cVW/hAuvGuoIFi3zSLVqtWf+7EtTVktOhOklkg2DrnLW0yh3LHQI4IVUfbiwAgnx
VkuLlgnRQEwSTjKfQSc8mIpKkIgCmKkphWzDNhJUcXbDvGIQtbGnxTD0oWEpjMXV
1/XZpNqasGiPeAezjjNNgrZiltFwy2kWoH/scXKKeBn8HBLDnZxGEjRRvOnL9zc+
53ruUXY3jcLZhiigPupxDNXotWex3o+jgt6Xi9vap59vSpKhiPwbJ6/AFQMHSH9Q
QC0mWkRkhRfNP6m+Aw7vBf3/7Sl1cy9GHjdg1bfL6Ug8RK/hiYI=
=AlF2
-----END PGP SIGNATURE-----