Exploit for Deserialization of Untrusted Data in Flask-Caching_Project Flask-Caching

CVE-2021-3...

Linux Distros Unpatched Vulnerability : CVE-2021-33026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. ...

Exploit for Deserialization of Untrusted Data in Flask-Caching_Project Flask-Caching

It is an offensive tool for web exploitation. This PoC exploit t...

FreeBSD : py-flask-caching -- remote code execution or local privilege escalation vulnerabilities (692a5fd5-bb25-4df4-8a0e-eb91581f2531)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 692a5fd5-bb25-4df4-8a0e-eb91581f2531 advisory. - DISPUTED The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, whi...

Security Bulletin: Vulnerability in Flask and Python affects IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore (CVE-2021-33026, CVE-2022-0391)

Summary Elevation of privileges vulnerability in Flask and weaker than expected security in Python can affect IBM Spectrum Protect Plus Microsoft® File Systems backup and restore. Vulnerability Details CVEID: CVE-2021-33026 DESCRIPTION: Flask-Caching extension for Flask could allow a local...

Django: Deserialization of potentially malicious data to RCE

Hello, Django Team! It's my first time working with you, hope it will be great! Note: I have not seen this issue neither in known vulnerabilities nor in documentation, so here I am. Summary Several type of caches in https://github.com/django/django/tree/main/django/core/cache/backends use python...

aeros (>=2.0.0a1 <=2.0.0b4), apache-airflow-zack (=1.10.15.9) +16 more potentially affected by CVE-2021-33026 via flask-caching (=1.10.1)

flask-caching PYPI version =1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-caching and may be impacted: - aeros =2.0.0a1, =2.1.1.3, =0.0.0a0, =2.0.0, =3.1.0, =1.2.31, =0.16.5, =0.4.0, =0.2.14, =2.3.7, =2.3.20 and more Source cves:...

CVE-2021-33026

creationtimestamp| type| source ---|---|--- 2021-05-14 08:23:48+00:00| seen| Telegram/knI708qd9e5cBA6OcAAL1PN-qF4Yp7ivnocsAk0imOcGI 2021-11-06 13:48:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/4690 2021-11-08 14:43:04+00:00| published-proof-of-concept|...

CVE-2021-33026

The CVE-2021-33026 entry concerns Flask-Caching up to 1.10.1 which uses Pickle for serialization. If an attacker can access cache storage (filesystem, Memcached, Redis, etc.), they can craft a payload to poison the cache and execute Python code (remote code execution/local privilege escalation). ...