python-flask-cors: CVE-2024-1681

Debian Bug report logs - #1069764
python-flask-cors: CVE-2024-1681

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: submit@bugs.debian.org

Subject: python-flask-cors: CVE-2024-1681

Date: Wed, 24 Apr 2024 13:42:55 +0200

Source: python-flask-cors
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for python-flask-cors.

CVE-2024-1681[0]:
| corydolphin/flask-cors is vulnerable to log injection when the log
| level is set to debug. An attacker can inject fake log entries into
| the log file by sending a specially crafted GET request containing a
| CRLF sequence in the request path. This vulnerability allows
| attackers to corrupt log files, potentially covering tracks of other
| attacks, confusing log post-processing tools, and forging log
| entries. The issue is due to improper output neutralization for
| logs.

https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644
https://github.com/corydolphin/flask-cors/issues/349


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-1681
    https://www.cve.org/CVERecord?id=CVE-2024-1681

Please adjust the affected versions in the BTS as needed.

Send a report that this bug log contains spam.