csaf_redhat - rhsa-2023

rhsa-2023_3440

Vulnerability from csaf_redhat

Published

2023-06-05 18:53

Modified

2024-11-14 00:02

Summary

Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-flask) security update

Notes

Topic

An update for python-flask is now available for Red Hat OpenStack Platform 17.0 (Wallaby). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Flask is called a “micro-framework” because the idea to keep the core simple but extensible. There is no database abstraction layer, no form validation or anything else where different libraries already exist that can handle that. However Flask knows the concept of extensions that can add this functionality into your application as if it was implemented in Flask itself. There are currently extensions for object relational mappers, form validation, upload handling, various open authentication technologies and more. Security Fix(es): * Possible disclosure of permanent session cookie due to missing Vary: Cookie header (CVE-2023-30861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for python-flask is now available for Red Hat OpenStack Platform\n17.0 (Wallaby).\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Flask is called a \u201cmicro-framework\u201d because the idea to keep the core\nsimple but extensible. There is no database abstraction layer, no form\nvalidation or anything else where different libraries already exist that\ncan handle that. However Flask knows the concept of extensions that can add\nthis functionality into your application as if it was implemented in Flask\nitself. There are currently extensions for object relational mappers, form\nvalidation, upload handling, various open authentication technologies and\nmore.\n\nSecurity Fix(es):\n\n* Possible disclosure of permanent session cookie due to missing Vary:\nCookie header (CVE-2023-30861)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:3440",
        "url": "https://access.redhat.com/errata/RHSA-2023:3440"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2196643",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196643"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3440.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-flask) security update",
    "tracking": {
      "current_release_date": "2024-11-14T00:02:25+00:00",
      "generator": {
        "date": "2024-11-14T00:02:25+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2023:3440",
      "initial_release_date": "2023-06-05T18:53:41+00:00",
      "revision_history": [
        {
          "date": "2023-06-05T18:53:41+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-06-05T18:53:41+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T00:02:25+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 17.0",
                "product": {
                  "name": "Red Hat OpenStack Platform 17.0",
                  "product_id": "9Base-RHOS-17.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:17.0::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-flask-1:1.1.2-6.el9ost.src",
                "product": {
                  "name": "python-flask-1:1.1.2-6.el9ost.src",
                  "product_id": "python-flask-1:1.1.2-6.el9ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-flask@1.1.2-6.el9ost?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-flask-1:1.1.2-6.el9ost.noarch",
                "product": {
                  "name": "python3-flask-1:1.1.2-6.el9ost.noarch",
                  "product_id": "python3-flask-1:1.1.2-6.el9ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-flask@1.1.2-6.el9ost?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-flask-1:1.1.2-6.el9ost.src as a component of Red Hat OpenStack Platform 17.0",
          "product_id": "9Base-RHOS-17.0:python-flask-1:1.1.2-6.el9ost.src"
        },
        "product_reference": "python-flask-1:1.1.2-6.el9ost.src",
        "relates_to_product_reference": "9Base-RHOS-17.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-flask-1:1.1.2-6.el9ost.noarch as a component of Red Hat OpenStack Platform 17.0",
          "product_id": "9Base-RHOS-17.0:python3-flask-1:1.1.2-6.el9ost.noarch"
        },
        "product_reference": "python3-flask-1:1.1.2-6.el9ost.noarch",
        "relates_to_product_reference": "9Base-RHOS-17.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-30861",
      "cwe": {
        "id": "CWE-488",
        "name": "Exposure of Data Element to Wrong Session"
      },
      "discovery_date": "2023-05-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2196643"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions are met by the proxy\u0027s behavior regarding cookies and the application\u0027s behavior session usage:\r\n1. The caching proxy does not strip or ignore response with cookies\r\n2. The application sets a permanent session\r\n3. The application does not access or modify the session during requests\r\n4. SESSION_REFRESH_EACH_REQUEST is enabled, which is the default Flask behavior\r\n5. The application does not set the Cache-Control header to avoid being cached",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOS-17.0:python-flask-1:1.1.2-6.el9ost.src",
          "9Base-RHOS-17.0:python3-flask-1:1.1.2-6.el9ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-30861"
        },
        {
          "category": "external",
          "summary": "RHBZ#2196643",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196643"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-30861",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-30861"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-30861",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30861"
        },
        {
          "category": "external",
          "summary": "https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b",
          "url": "https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b"
        },
        {
          "category": "external",
          "summary": "https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq",
          "url": "https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq"
        }
      ],
      "release_date": "2023-05-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-06-05T18:53:41+00:00",
          "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHOS-17.0:python-flask-1:1.1.2-6.el9ost.src",
            "9Base-RHOS-17.0:python3-flask-1:1.1.2-6.el9ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:3440"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOS-17.0:python-flask-1:1.1.2-6.el9ost.src",
            "9Base-RHOS-17.0:python3-flask-1:1.1.2-6.el9ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header"
    }
  ]
}

cve-2023-30861

Vulnerability from cvelistv5

Published

2023-05-02 17:04

Modified

2024-08-02 14:37

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

References

▼	URL	Tags
	https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq	x_refsource_CONFIRM
	https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b	x_refsource_MISC
	https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965	x_refsource_MISC
	https://github.com/pallets/flask/releases/tag/2.2.5	x_refsource_MISC
	https://github.com/pallets/flask/releases/tag/2.3.2	x_refsource_MISC
	https://www.debian.org/security/2023/dsa-5442
	https://security.netapp.com/advisory/ntap-20230818-0006/
	https://lists.debian.org/debian-lts-announce/2023/08/msg00024.html

Impacted products

Vendor

Product

Version

▼

pallets

flask

Version: >= 2.3.0, < 2.3.2
Version: < 2.2.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:37:15.503Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq"
          },
          {
            "name": "https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b"
          },
          {
            "name": "https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965"
          },
          {
            "name": "https://github.com/pallets/flask/releases/tag/2.2.5",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pallets/flask/releases/tag/2.2.5"
          },
          {
            "name": "https://github.com/pallets/flask/releases/tag/2.3.2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pallets/flask/releases/tag/2.3.2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5442"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230818-0006/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "flask",
          "vendor": "pallets",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.3.2"
            },
            {
              "status": "affected",
              "version": "\u003c 2.2.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client\u0027s `session` cookie to other clients. The severity depends on the application\u0027s use of the session and the proxy\u0027s behavior regarding cookies. The risk depends on all these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-539",
              "description": "CWE-539: Use of Persistent Cookies Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-02T17:04:22.197Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq"
        },
        {
          "name": "https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b"
        },
        {
          "name": "https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965"
        },
        {
          "name": "https://github.com/pallets/flask/releases/tag/2.2.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pallets/flask/releases/tag/2.2.5"
        },
        {
          "name": "https://github.com/pallets/flask/releases/tag/2.3.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pallets/flask/releases/tag/2.3.2"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5442"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230818-0006/"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00024.html"
        }
      ],
      "source": {
        "advisory": "GHSA-m2qf-hxjv-5gpq",
        "discovery": "UNKNOWN"
      },
      "title": "Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-30861",
    "datePublished": "2023-05-02T17:04:22.197Z",
    "dateReserved": "2023-04-18T16:13:15.882Z",
    "dateUpdated": "2024-08-02T14:37:15.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted