Debian DLA-1892-1 : flask security update

Flask, a micro web framework for Python contains a CWE-20: Improper Input Validation vulnerability that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. For Debian 8...

[SECURITY] [DLA 1892-1] flask security update

Package : flask Version : 0.10.1-2+deb8u1 CVE ID : CVE-2018-1000656 Flask, a micro web framework for Python contains a CWE-20: Improper Input Validation vulnerability that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via...

DLA-1892-1 flask - security update

Bulletin has no description...

alignak-backend (>=1.4.15, <=1.4.16), alignak-webui (>=0.11.1, <=0.12.2) +11 more potentially affected by CVE-2019-1010083 via flask (0.12.0)

flask PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - alignak-backend =1.4.15, =0.11.1, =0.1.0, =0.5.0, =1.0.8, =4.5.0, =0.2.0.dev0, =0.2.0, =23.1.0, =1.0.2, =1.0.5 - showcase 0.3.4 Source cves:...

autologin (>=0.1.1, <=0.1.3), cabu (0.0.2) +20 more potentially affected by CVE-2019-1010083 via flask (0.10.1)

flask PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - autologin =0.1.1, =1.2.1, =2.2.11, =0.5.0, =0.1.0, =0.0.1, =0.3.1, =0.6.2, =0.0.1, =0.0.1, =0.1.12 and more Source cves: CVE-2019-1010083 Source...

Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage

The Pallets Project Flask before 1.0 is affected by unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. The fixed version is 1. NOTE this may overlap CVE-2018-1000656...

gym-http-server (0.0.1), komand (3.2.0) +1 more potentially affected by CVE-2019-1010083 via flask (0.12.3)

flask PYPI version 0.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - gym-http-server 0.0.1 - komand 3.2.0 - shrunk 0.6.1 Source cves: CVE-2019-1010083 Source advisory: OSV:GHSA-5WV5-4VPF-PJ6M...

allennlp (>=0.4.0, <=0.4.1), bentodev (>=0.1.17, <=2018.11.2) +7 more potentially affected by CVE-2019-1010083 via flask (0.12.1)

flask PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - allennlp =0.4.0, =0.1.17, =0.1.0, =0.9.2, =0.1.48, =0.1.0, =0.2.5 - spiderkeeper-zam 1.2.2 Source cves: CVE-2019-1010083 Source advisory:...

burp-ui (>=0.6.0, <=0.6.6), dagit (>=0.3.2, <=0.4.3.post4) +4 more potentially affected by CVE-2019-1010083 via flask (0.12.4)

flask PYPI version 0.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - burp-ui =0.6.0, =0.3.2, =0.1.1, =0.1.1, =0.10.0, =2.0.2, =2.0.3 Source cves: CVE-2019-1010083 Source advisory: OSV:GHSA-5WV5-4VPF-PJ6M...

almanach (>=4.0.0, <=4.1.0), alo7-airflow (>=1.10.0, <=1.10.0.7) +37 more potentially affected by CVE-2019-1010083 via flask (0.12.5)

flask PYPI version 0.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - almanach =4.0.0, =1.10.0, =0.14.0, =1.0.18, =0.1.0, =0.0.1a0, =0.0.3a0, =3.0.0, =0.1.0, =0.2.1 and more Source cves: CVE-2019-1010083 Source advisory...

abbr (0.0.0), blendedux (0.0.2) +32 more potentially affected by CVE-2019-1010083 via flask (0.11.1)

flask PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - abbr 0.0.0 - blendedux 0.0.2 - burp-ui =0.4.1, =4.3.2, =1.4.3, =1.0.0.dev5, =1.0.0.dev0, =0.23.22, =0.0.1, =2.5.3, =0.18.1, =0.1.1, =1.0.0a1, =1.1.0...

aequitas (>=0.26.0, <=0.42.0), appkernel (>=0.1.0, <=1.0.0) +37 more potentially affected by CVE-2019-1010083 via flask (0.12.2)

flask PYPI version 0.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - aequitas =0.26.0, =0.1.0, =0.7.1, =0.1.0, =0.0.1, =0.0.5.1, =0.0.2, =0.1.1, =0.12.0, =2.10.60, =0.1.0, =0.2.0, =1.1.0, =1.2.0 and more Source cves:...

GHSA-5WV5-4VPF-PJ6M Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage

The Pallets Project Flask before 1.0 is affected by unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. The fixed version is 1. NOTE this may overlap CVE-2018-1000656...

Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage

The Pallets Project Flask before 1.0 is affected by unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. The fixed version is 1. NOTE this may overlap CVE-2018-1000656...

Denial Of Service (DoS)

flask is vulnerable to denial of service. An attacker is able to crash the application from an unexpected memory usage by submitting malicious JSON data containing non-UTF8 charatcers...

CVE-2019-1010083

The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656...

CVE-2019-1010083

The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656...

DEBIAN-CVE-2019-1010083

The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656...

Code injection

The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656...

PYSEC-2019-179

The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656...