PT-2021-19969 · Unknown · Flask-Restx

Kevin Backhouse · Published 2021-09-08 · Updated 2021-10-13 · CVE-2021-32838

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flask-RESTX versions prior to 0.5.1

Description The issue is related to a Regular Expression Denial of Service (ReDoS) vulnerability in the email regex of Flask-RESTX. This vulnerability can be exploited, potentially leading to a denial of service.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 to resolve the issue. As a temporary workaround, consider restricting the use of the email regex until a patch is available.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

CVE-2021-32838

GHSA-3Q6G-VF58-7M4G

MGASA-2021-0473

PYSEC-2021-325

Affected Products

Flask-Restx

References · 22

• https://github.com/python-restx/flask-restx/commit/bab31e085f355dd73858fd3715f7ed71849656da · Patch
• https://github.com/python-restx/flask-restx/issues/372 · Patch
• https://github.com/python-restx/flask-restx/blob/fd99fe11a88531f5f3441a278f7020589f9d2cc0/flask_restx/inputs.py#L51 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/5UCTFVDU3677B5OBGK4EF5NMUPJLL6SQ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUD6SWZLX52AAZUHDETJ2CDMQGEPGFL3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32838 · Security Note
• https://osv.dev/vulnerability/GHSA-3q6g-vf58-7m4g · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/QUD6SWZLX52AAZUHDETJ2CDMQGEPGFL3 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-325 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32838 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0473 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0473.html · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5UCTFVDU3677B5OBGK4EF5NMUPJLL6SQ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/5UCTFVDU3677B5OBGK4EF5NMUPJLL6SQ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QUD6SWZLX52AAZUHDETJ2CDMQGEPGFL3 · Vendor Advisory