CVE-2021-33026

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload, poison the...

DEBIAN-CVE-2021-33026

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload, poison the...

UBUNTU-CVE-2021-33026

DISPUTED The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload,...

PYSEC-2021-13

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload, poison the...

Remote code execution

DISPUTED The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload,...

PYSEC-2021-13

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload, poison the...

CVE-2021-33026

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload, poison the...

CVE-2021-33026

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload, poison the...

CVE-2021-33026

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload, poison the...

CVE-2021-33026

The CVE-2021-33026 entry concerns Flask-Caching up to 1.10.1 which uses Pickle for serialization. If an attacker can access cache storage (filesystem, Memcached, Redis, etc.), they can craft a payload to poison the cache and execute Python code (remote code execution/local privilege escalation). ...

CVE-2021-33026

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload, poison the...

CVE-2021-33026

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload, poison the...

CVE-2021-33026: Deserialization of Untrusted Data

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payload, poison the...

PT-2021-28361

Name of the Vulnerable Software and Affected Versions: Flask-Caching versions through 1.10.1 Description: The issue allows for remote code execution or local privilege escalation due to the reliance on Pickle for serialization. An attacker who gains access to cache storage, such as filesystem,...

Pallets Project Flask code issue vulnerabilities

Pallets Project Flask is a lightweight WSGI Web Server Gateway Interface application framework from the Pallets Project. A code issue vulnerability exists in Flask version 1.10.1. The vulnerability stems from program extensions relying on Pickle for serialization, which could lead to remote code...

py-flask-caching -- remote code execution or local privilege escalation vulnerabilities

subnix reports: The Flask-Caching extension through 2.0.2 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payloa...

GHSA-XC3P-FF3M-F46V Flask-Cors Directory Traversal vulnerability

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

wikilabels (>=0.3.1, <=0.4.0) potentially affected by CVE-2020-25032 via flask-cors (2.1.3)

flask-cors PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - wikilabels =0.3.1, =0.4.0 Source cves: CVE-2020-25032 Source advisory: OSV:GHSA-XC3P-FF3M-F46V...

feather (>=0.0.6, <=0.0.8) potentially affected by CVE-2020-25032 via flask-cors (1.1.2)

flask-cors PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - feather =0.0.6, =0.0.8 Source cves: CVE-2020-25032 Source advisory: OSV:GHSA-XC3P-FF3M-F46V...

sevenpack (2.7.1) potentially affected by CVE-2020-25032 via flask-cors (2.0.1)

flask-cors PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - sevenpack 2.7.1 Source cves: CVE-2020-25032 Source advisory: OSV:GHSA-XC3P-FF3M-F46V...