Debian Package Tracker
Register | Log in
Subscribe

python-flask-cors

Flask extension for handling CORS (Python 3)

Choose email to subscribe with

general
  • source: python-flask-cors (main)
  • version: 6.0.0-1
  • maintainer: Debian Python Team (DMD)
  • uploaders: Stewart Ferguson [DMD]
  • arch: all
  • std-ver: 4.7.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 3.0.7-1+deb10u1
  • o-o-sec: 3.0.7-1+deb10u1
  • oldstable: 3.0.9-2
  • old-sec: 3.0.9-2+deb11u1
  • stable: 3.0.10-2
  • testing: 5.0.1-1
  • unstable: 6.0.0-1
versioned links
  • 3.0.7-1+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.0.9-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.0.9-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.0.10-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 5.0.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.0.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • python3-flask-cors
action needed
3 security issues in trixie high

There are 3 open security issues in trixie.

3 important issues:
  • CVE-2024-6839: corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
  • CVE-2024-6844: A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
  • CVE-2024-6866: corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
Created: 2025-05-20 Last update: 2025-05-31 05:30
lintian reports 14 warnings normal
Lintian reports 14 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2025-05-21 Last update: 2025-05-21 04:31
4 low-priority security issues in bookworm low

There are 4 open security issues in bookworm.

4 issues left for the package maintainer to handle:
  • CVE-2024-1681: (needs triaging) corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
  • CVE-2024-6839: (postponed; to be fixed through a stable update) corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
  • CVE-2024-6844: (postponed; to be fixed through a stable update) A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
  • CVE-2024-6866: (postponed; to be fixed through a stable update) corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-04-23 Last update: 2025-05-31 05:30
debian/patches: 1 patch to forward upstream low

Among the 5 debian patches available in version 6.0.0-1 of the package, we noticed the following issues:

  • 1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2024-05-11 Last update: 2025-05-21 07:30
testing migrations
  • excuses:
    • Migration status for python-flask-cors (5.0.1-1 to 6.0.0-1): Waiting for test results or another package, or too young (no action required now - check later)
    • Issues preventing migration:
    • ∙ ∙ Too young, only 10 of 20 days old
    • Additional info:
    • ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/python-flask-cors.html
    • ∙ ∙ autopkgtest for python-flask-cors/6.0.0-1: amd64: Pass, arm64: Pass, armel: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
    • ∙ ∙ Reproducible on amd64 - info ♻
    • ∙ ∙ Reproducible on arm64 - info ♻
    • ∙ ∙ Waiting for reproducibility test results on armhf - info ♻
    • ∙ ∙ Waiting for reproducibility test results on i386 - info ♻
    • ∙ ∙ not blocked: has successful autopkgtest
    • Not considered
news
[rss feed]
  • [2025-05-31] Accepted python-flask-cors 3.0.9-2+deb11u1 (source) into oldstable-security (Daniel Leidert)
  • [2025-05-20] Accepted python-flask-cors 6.0.0-1 (source) into unstable (Carsten Schoenert)
  • [2025-03-28] python-flask-cors 5.0.1-1 MIGRATED to testing (Debian testing watch)
  • [2025-03-25] Accepted python-flask-cors 5.0.1-1 (source) into unstable (Carsten Schoenert)
  • [2024-09-16] python-flask-cors 5.0.0-1 MIGRATED to testing (Debian testing watch)
  • [2024-09-14] Accepted python-flask-cors 5.0.0-1 (source) into unstable (Carsten Schoenert)
  • [2024-05-13] python-flask-cors 4.0.1-1 MIGRATED to testing (Debian testing watch)
  • [2024-05-10] Accepted python-flask-cors 4.0.1-1 (source) into unstable (Carsten Schoenert)
  • [2023-06-30] python-flask-cors 4.0.0-1 MIGRATED to testing (Debian testing watch)
  • [2023-06-27] Accepted python-flask-cors 4.0.0-1 (source) into unstable (Carsten Schoenert)
  • [2023-01-24] python-flask-cors 3.0.10-2 MIGRATED to testing (Debian testing watch)
  • [2023-01-22] Accepted python-flask-cors 3.0.10-2 (source) into unstable (Carsten Schoenert)
  • [2022-11-04] python-flask-cors 3.0.10-1 MIGRATED to testing (Debian testing watch)
  • [2022-11-01] Accepted python-flask-cors 3.0.10-1 (source) into unstable (Carsten Schoenert)
  • [2020-12-21] python-flask-cors 3.0.9-2 MIGRATED to testing (Debian testing watch)
  • [2020-12-21] python-flask-cors 3.0.9-2 MIGRATED to testing (Debian testing watch)
  • [2020-12-18] Accepted python-flask-cors 3.0.9-2 (source) into unstable (Louis-Philippe Véronneau)
  • [2020-12-18] Accepted python-flask-cors 3.0.9-1 (source) into unstable (Louis-Philippe Véronneau)
  • [2020-10-24] Accepted python-flask-cors 3.0.7-1+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
  • [2020-10-19] Accepted python-flask-cors 3.0.7-1+deb10u1 (source) into stable->embargoed, stable (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
  • [2020-02-28] python-flask-cors REMOVED from testing (Debian testing watch)
  • [2019-08-12] python-flask-cors 3.0.8-2 MIGRATED to testing (Debian testing watch)
  • [2019-08-06] Accepted python-flask-cors 3.0.8-2 (source) into unstable (Stewart Ferguson) (signed by: Mattia Rizzolo)
  • [2019-06-10] Accepted python-flask-cors 3.0.8-1 (source all) into unstable (Stewart Ferguson) (signed by: Piotr Ozarowski)
  • [2018-12-30] python-flask-cors 3.0.7-1 MIGRATED to testing (Debian testing watch)
  • [2018-12-24] Accepted python-flask-cors 3.0.7-1 (source all) into unstable, unstable (Stewart Ferguson) (signed by: Piotr Ozarowski)
bugs [bug history graph]
  • all: 1
  • RC: 0
  • I&N: 1
  • M&W: 0
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian (0, 14)
  • buildd: logs, reproducibility
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 6.0.0-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing