Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2020-25032]

Summary The Flask-Cors package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2020-25032. Vulnerability Details CVEID:CVE-2020-25032 DESCRIPTION: Flask-CORS could allow a remote attacker to traverse directories on the system. A...

Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [ CVE-2020-25032]

Summary The Flask-Cors package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVE CVE-2020-25032. Vulnerability Details CVEID:CVE-2020-25032 DESCRIPTION: Flask-CORS could allow a remote attacker to traverse directories on the system. ...

SUSE CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

[SECURITY] [DSA 4775-1] python-flask-cors security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4775-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4775-1] python-flask-cors security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4775-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2020 https://www.debian.org/security/faq -...

Security update for python-Flask-Cors (moderate)

openSUSE Security Update: Security update for python-Flask-Cors Announcement ID: openSUSE-SU-2020:1446-1 Rating: moderate References: 1175986 Cross-References: CVE-2020-25032 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes one vulnerability is now available. Description: Thi...

OPENSUSE-SU-2020:1423-1 Security update for python-Flask-Cors

This update for python-Flask-Cors fixes the following issues: - CVE-2020-25032: fix a relative directory traversal vulnerability bsc1175986. This update was imported from the openSUSE:Leap:15.2:Update update project...

OPENSUSE-SU-2020:1415-1 Security update for python-Flask-Cors

This update for python-Flask-Cors fixes the following issues: - CVE-2020-25032: fix a relative directory traversal vulnerability bsc1175986. This update was imported from the openSUSE:Leap:15.1:Update update project...

openSUSE Security Update : python-Flask-Cors (openSUSE-2020-1393)

This update for python-Flask-Cors fixes the following issues : - CVE-2020-25032: fix a relative directory traversal vulnerability bsc1175986. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2020-1393. Th...

openSUSE: Security Advisory for python-Flask-Cors (openSUSE-SU-2020:1393-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for python-Flask-Cors (moderate)

openSUSE Security Update: Security update for python-Flask-Cors Announcement ID: openSUSE-SU-2020:1393-1 Rating: moderate References: 1175986 Cross-References: CVE-2020-25032 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 An update that fixes one vulnerability is now available...

CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

CVE-2020-25032

CVE-2020-25032 affects Flask-CORS (CORS Middleware for Flask) versions before 3.0.9. The issue allows directory traversal via /../ sequences because resource matching does not canonicalize pathnames, potentially exposing private files. Public sources in the connected documents confirm affected pr...