PT-2019-11460 · Pallets+1 · Flask+1

Published 2019-07-17 · Updated 2023-04-20 · CVE-2019-1010083

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: The Pallets Project Flask versions prior to 1.0

Description: The issue is related to unexpected memory usage, which can lead to denial of service. The attack vector involves crafted encoded JSON data.

Recommendations: For versions prior to 1.0, update to version 1.0 or later to resolve the issue. As a temporary workaround, consider restricting the handling of encoded JSON data to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2019-1010083

GHSA-5WV5-4VPF-PJ6M

PYSEC-2019-179

SUSE-SU-2020:1901-1

SUSE-SU-2023:1928-1

SUSE-SU-2023_1928-1

Affected Products

Flask

Suse

References · 75

• https://osv.dev/vulnerability/UBUNTU-CVE-2019-1010083 · Vendor Advisory
• https://palletsprojects.com/blog/flask-1-0-released · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-1010083 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1928-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5wv5-4vpf-pj6m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010083 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-1010083 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-1010083 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1901-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-179 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1010083 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1010083 · Vendor Advisory
• https://github.com/pallets/flask · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2019-179.yaml · Note
• https://bugzilla.suse.com/1160153 · Note