pi-nexus-autonomous-banking-network icon indicating copy to clipboard operation
pi-nexus-autonomous-banking-network copied to clipboard

Published 20 hours ago • verified publisher icon KOSASIH

Flask_Cors-3.0.10-py2.py3-none-any.whl: 1 vulnerabilities (highest severity is: 5.3)

Open mend-bolt-for-github[bot] opened this issue 1 year ago • 1 comments

Vulnerable Library - Flask_Cors-3.0.10-py2.py3-none-any.whl

A Flask extension adding a decorator for CORS support

Library home page: https://files.pythonhosted.org/packages/db/84/901e700de86604b1c4ef4b57110d4e947c218b9997adf5d38fa7da493bce/Flask_Cors-3.0.10-py2.py3-none-any.whl

Path to dependency file: /app/requirements.txt

Path to vulnerable library: /app/requirements.txt

Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (Flask_Cors version) Remediation Possible**
CVE-2024-1681 Medium 5.3 Flask_Cors-3.0.10-py2.py3-none-any.whl Direct flask-cors - 4.0.1 ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-1681

Vulnerable Library - Flask_Cors-3.0.10-py2.py3-none-any.whl

A Flask extension adding a decorator for CORS support

Library home page: https://files.pythonhosted.org/packages/db/84/901e700de86604b1c4ef4b57110d4e947c218b9997adf5d38fa7da493bce/Flask_Cors-3.0.10-py2.py3-none-any.whl

Path to dependency file: /app/requirements.txt

Path to vulnerable library: /app/requirements.txt

Dependency Hierarchy:

  • :x: Flask_Cors-3.0.10-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf

Found in base branch: main

Vulnerability Details

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.

Publish Date: 2024-04-19

URL: CVE-2024-1681

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None
For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-84pr-m4jr-85g5

Release Date: 2024-04-19

Fix Resolution: flask-cors - 4.0.1

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] avatar May 23 '24 04:05 mend-bolt-for-github[bot]

Test

jiiitVDA avatar May 23 '24 17:05 jiiitVDA

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-bolt-for-github[bot] avatar Aug 08 '24 01:08 mend-bolt-for-github[bot]