PT-2018-9508 · Pallets+2 · Flask+2

David Lord + 1 · Published 2018-08-20 · Updated 2020-06-09 · CVE-2018-1000656

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flask versions prior to 0.12.3

Description The issue is related to improper input validation, which can result in a large amount of memory usage, possibly leading to denial of service. This can be exploited when an attacker provides JSON data in incorrect encoding.

Recommendations For versions prior to 0.12.3, update to version 0.12.3 to resolve the issue. As a temporary workaround, consider restricting the handling of JSON data with incorrect encoding to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-1000656

DLA-1892-1

GHSA-562C-5R94-XH97

OPENSUSE-SU-2019:1112-1

OPENSUSE-SU-2019_1112-1

PYSEC-2018-66

RHSA-2020:0870

SUSE-SU-2019:0657-1

USN-4378-1

Affected Products

Flask

Suse

Ubuntu

References · 27

• https://github.com/pallets/flask/pull/2691 · Patch
• https://osv.dev/vulnerability/CVE-2018-1000656 · Vendor Advisory
• https://usn.ubuntu.com/4378-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1112-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000656 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-1000656 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000656 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000656 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20190221-0001 · Patch
• https://osv.dev/vulnerability/DLA-1892-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-562c-5r94-xh97 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4378-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-66 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4378-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0657-1 · Vendor Advisory