python-flask-cors - Debian Package Tracker

general

source: python-flask-cors (main)
version: 5.0.1-1
maintainer: Debian Python Team (DMD)
uploaders: Stewart Ferguson [DMD]
arch: all
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.0.7-1+deb10u1
o-o-sec: 3.0.7-1+deb10u1
oldstable: 3.0.9-2
stable: 3.0.10-2
testing: 5.0.1-1
unstable: 5.0.1-1

versioned links

3.0.7-1+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.9-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.10-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.0.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python3-flask-cors

action needed

Marked for autoremoval on 10 May due to pydantic-core: #1101417 high

Version 5.0.1-1 of python-flask-cors is marked for autoremoval from testing on Sat 10 May 2025. It depends (transitively) on pydantic-core, affected by #1101417. You should try to prevent the removal by fixing these RC bugs.

Created: 2025-04-06 Last update: 2025-04-13 21:30

Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

error: RPC failed; HTTP 500 curl 22 The requested URL returned error: 500 fatal: expected flush after ref listing

Created: 2025-04-11 Last update: 2025-04-11 18:30

3 security issues in trixie high

There are 3 open security issues in trixie.

3 important issues:

CVE-2024-6839: corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
CVE-2024-6844: A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
CVE-2024-6866: corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.

Created: 2025-03-21 Last update: 2025-04-08 06:32

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2024-6839: corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
CVE-2024-6844: A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
CVE-2024-6866: corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.

Created: 2025-03-21 Last update: 2025-04-08 06:32

5 security issues in bullseye high

There are 5 open security issues in bullseye.

3 important issues:

CVE-2024-6839: corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
CVE-2024-6844: A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
CVE-2024-6866: corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.

2 issues postponed or untriaged:

CVE-2024-1681: (needs triaging) corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
CVE-2024-6221: (postponed; to be fixed through a stable update) A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.

Created: 2025-03-21 Last update: 2025-04-08 06:32

5 security issues in bookworm high

There are 5 open security issues in bookworm.

3 important issues:

CVE-2024-6839: corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
CVE-2024-6844: A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
CVE-2024-6866: corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.

2 issues left for the package maintainer to handle:

CVE-2024-1681: (needs triaging) corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
CVE-2024-6221: (postponed; to be fixed through a stable update) A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-04-23 Last update: 2025-04-08 06:32

lintian reports 14 warnings normal

Lintian reports 14 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-04-10 Last update: 2025-04-10 00:31

debian/patches: 1 patch to forward upstream low

Among the 5 debian patches available in version 5.0.1-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2024-05-11 Last update: 2025-03-26 10:01

news

[rss feed]

[2025-03-28] python-flask-cors 5.0.1-1 MIGRATED to testing (Debian testing watch)
[2025-03-25] Accepted python-flask-cors 5.0.1-1 (source) into unstable (Carsten Schoenert)
[2024-09-16] python-flask-cors 5.0.0-1 MIGRATED to testing (Debian testing watch)
[2024-09-14] Accepted python-flask-cors 5.0.0-1 (source) into unstable (Carsten Schoenert)
[2024-05-13] python-flask-cors 4.0.1-1 MIGRATED to testing (Debian testing watch)
[2024-05-10] Accepted python-flask-cors 4.0.1-1 (source) into unstable (Carsten Schoenert)
[2023-06-30] python-flask-cors 4.0.0-1 MIGRATED to testing (Debian testing watch)
[2023-06-27] Accepted python-flask-cors 4.0.0-1 (source) into unstable (Carsten Schoenert)
[2023-01-24] python-flask-cors 3.0.10-2 MIGRATED to testing (Debian testing watch)
[2023-01-22] Accepted python-flask-cors 3.0.10-2 (source) into unstable (Carsten Schoenert)
[2022-11-04] python-flask-cors 3.0.10-1 MIGRATED to testing (Debian testing watch)
[2022-11-01] Accepted python-flask-cors 3.0.10-1 (source) into unstable (Carsten Schoenert)
[2020-12-21] python-flask-cors 3.0.9-2 MIGRATED to testing (Debian testing watch)
[2020-12-21] python-flask-cors 3.0.9-2 MIGRATED to testing (Debian testing watch)
[2020-12-18] Accepted python-flask-cors 3.0.9-2 (source) into unstable (Louis-Philippe Véronneau)
[2020-12-18] Accepted python-flask-cors 3.0.9-1 (source) into unstable (Louis-Philippe Véronneau)
[2020-10-24] Accepted python-flask-cors 3.0.7-1+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2020-10-19] Accepted python-flask-cors 3.0.7-1+deb10u1 (source) into stable->embargoed, stable (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2020-02-28] python-flask-cors REMOVED from testing (Debian testing watch)
[2019-08-12] python-flask-cors 3.0.8-2 MIGRATED to testing (Debian testing watch)
[2019-08-06] Accepted python-flask-cors 3.0.8-2 (source) into unstable (Stewart Ferguson) (signed by: Mattia Rizzolo)
[2019-06-10] Accepted python-flask-cors 3.0.8-1 (source all) into unstable (Stewart Ferguson) (signed by: Piotr Ozarowski)
[2018-12-30] python-flask-cors 3.0.7-1 MIGRATED to testing (Debian testing watch)
[2018-12-24] Accepted python-flask-cors 3.0.7-1 (source all) into unstable, unstable (Stewart Ferguson) (signed by: Piotr Ozarowski)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 14)
buildd: logs, reproducibility
popcon
browse source code
edit tags
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.0.0-1