PT-2018-9508 · Pallets+2 · Flask+2

David Lord + 1 · Publicado 2018-08-20 · Atualizado 2020-06-09 · CVE-2018-1000656

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flask versions prior to 0.12.3

Description The issue is related to improper input validation, which can result in a large amount of memory usage, possibly leading to denial of service. This can be exploited when an attacker provides JSON data in incorrect encoding.

Recommendations For versions prior to 0.12.3, update to version 0.12.3 to resolve the issue. As a temporary workaround, consider restricting the handling of JSON data with incorrect encoding to minimize the risk of exploitation.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-1000656

DLA-1892-1

GHSA-562C-5R94-XH97

OPENSUSE-SU-2019:1112-1

OPENSUSE-SU-2019_1112-1

PYSEC-2018-66

RHSA-2020:0870

SUSE-SU-2019:0657-1

USN-4378-1

Produtos afetados

Flask

Suse

Ubuntu

Referências · 27

• https://github.com/pallets/flask/pull/2691 · Correção
• https://github.com/pallets/flask/releases/tag/0.12.3 · Nota
• https://github.com/pallets/flask · Nota
• https://github.com/pallets/flask/commit/b178e89e4456e777b1a7ac6d7199052d0dfdbbbe · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2018-66.yaml · Nota
• https://osv.dev/vulnerability/CVE-2018-1000656 · Aviso do Fabricante
• https://usn.ubuntu.com/4378-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2019:1112-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000656 · Nota de Segurança
• https://lists.opensuse.org/archives/list/[e-mail]/thread/QUU23JPF524WRYT6P2BYP5R5F5XP2QR2/#QUU23JPF524WRYT6P2BYP5R5F5XP2QR2 · Nota
• https://suse.com/security/cve/CVE-2018-1000656 · Nota
• https://cve.org/CVERecord?id=CVE-2018-1000656 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000656 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000656 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20190221-0001 · Correção