Arch Linux alert ASA-202105-2 (python-flask-security-too)
| From: | Jonas Witschel via arch-security <arch-security@lists.archlinux.org> | |
| To: | arch-security@lists.archlinux.org | |
| Subject: | [ASA-202105-2] python-flask-security-too: cross-site request forgery | |
| Date: | Thu, 20 May 2021 19:59:17 +0200 | |
| Message-ID: | <20210520175917.2ycmecstagc5q23t@archlinux.org> | |
| Cc: | Jonas Witschel <diabonas@archlinux.org> |
Arch Linux Security Advisory ASA-202105-2 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-21241 Package : python-flask-security-too Type : cross-site request forgery Remote : Yes Link : https://security.archlinux.org/AVG-1434 Summary ======= The package python-flask-security-too before version 4.0.1-1 is vulnerable to cross-site request forgery. Resolution ========== Upgrade to 4.0.1-1. # pacman -Syu "python-flask-security-too>=4.0.1-1" The problem has been fixed upstream in version 4.0.1. Workaround ========== If you aren't using authentication tokens, you can set SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. Description =========== In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. Impact ====== A remote attacker could obtain a user's authentication token from a cross-site request. References ========== https://bugs.archlinux.org/task/70041 https://github.com/Flask-Middleware/flask-security/securi... https://github.com/Flask-Middleware/flask-security/issues... https://github.com/Flask-Middleware/flask-security/pull/422 https://github.com/Flask-Middleware/flask-security/commit... https://security.archlinux.org/CVE-2021-21241