Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2020-25032]

Summary The Flask-Cors package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2020-25032. Vulnerability Details CVEID:CVE-2020-25032 DESCRIPTION: Flask-CORS could allow a remote attacker to traverse directories on the system. A...

Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [ CVE-2020-25032]

Summary The Flask-Cors package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVE CVE-2020-25032. Vulnerability Details CVEID:CVE-2020-25032 DESCRIPTION: Flask-CORS could allow a remote attacker to traverse directories on the system. ...

SUSE CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

ag-llama-api (>=0.0.1 <=0.0.31), ag-llama-api-s (>=0.0.4 <=0.0.12) +403 more potentially affected by CVE-2020-25032 via flask-cors (>=1.1.2 <=3.0.8)

flask-cors PYPI version =1.1.2, =0.0.1, =0.0.4, =0.0.13, =1.0.2, =2.5.0, =2.5.0, =0.1.0b2696.post0.dev1, =0.1.8, =0.0.1, =1.0.2, =0.4.0, =0.1.0, =1.0.1, =0.14.0, =0.15.3 - amundsen-databuilder =5.1.0 and more Source cves: CVE-2020-25032 Source advisory: OSV:GHSA-XC3P-FF3M-F46V...

[SECURITY] [DSA 4775-1] python-flask-cors security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4775-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4775-1] python-flask-cors security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4775-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2020 https://www.debian.org/security/faq -...

Security update for python-Flask-Cors (moderate)

openSUSE Security Update: Security update for python-Flask-Cors Announcement ID: openSUSE-SU-2020:1446-1 Rating: moderate References: 1175986 Cross-References: CVE-2020-25032 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes one vulnerability is now available. Description: Thi...

OPENSUSE-SU-2020:1423-1 Security update for python-Flask-Cors

This update for python-Flask-Cors fixes the following issues: - CVE-2020-25032: fix a relative directory traversal vulnerability bsc1175986. This update was imported from the openSUSE:Leap:15.2:Update update project...

OPENSUSE-SU-2020:1415-1 Security update for python-Flask-Cors

This update for python-Flask-Cors fixes the following issues: - CVE-2020-25032: fix a relative directory traversal vulnerability bsc1175986. This update was imported from the openSUSE:Leap:15.1:Update update project...

openSUSE Security Update : python-Flask-Cors (openSUSE-2020-1393)

This update for python-Flask-Cors fixes the following issues : - CVE-2020-25032: fix a relative directory traversal vulnerability bsc1175986. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2020-1393. Th...

openSUSE: Security Advisory for python-Flask-Cors (openSUSE-SU-2020:1393-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for python-Flask-Cors (moderate)

openSUSE Security Update: Security update for python-Flask-Cors Announcement ID: openSUSE-SU-2020:1393-1 Rating: moderate References: 1175986 Cross-References: CVE-2020-25032 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 An update that fixes one vulnerability is now available...

ag-llama-api (>=0.0.1 <=0.0.31), ag-llama-api-s (>=0.0.4 <=0.0.12) +403 more potentially affected by CVE-2020-25032 via flask-cors (>=1.1.2 <=3.0.8)

flask-cors PYPI version =1.1.2, =0.0.1, =0.0.4, =0.0.13, =1.0.2, =2.5.0, =2.5.0, =0.1.0b2696.post0.dev1, =0.1.8, =0.0.1, =1.0.2, =0.4.0, =0.1.0, =1.0.1, =0.14.0, =0.15.3 - amundsen-databuilder =5.1.0 and more Source cves: CVE-2020-25032 Source advisory: OSV:PYSEC-2020-43...

CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

CVE-2020-25032

CVE-2020-25032 affects Flask-CORS (CORS Middleware for Flask) versions before 3.0.9. The issue allows directory traversal via /../ sequences because resource matching does not canonicalize pathnames, potentially exposing private files. Public sources in the connected documents confirm affected pr...