PyPI: flask
CVE-2018-1000656
Safety vulnerability ID: SFTY-20180820-80740
Safety legacy ID: pyup.io-36388
flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Overview
Flask is vulnerable to Denial of Service via incorrect encoding of JSON data
Advisory
flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20180820-80740/CVE-2018-1000656
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000656
- https://github.com/pallets/flask/pull/2691
- https://github.com/pallets/flask/releases/tag/0.12.3
- https://lists.debian.org/debian-lts-announce/2019/08/msg00025.html
- https://security.netapp.com/advisory/ntap-20190221-0001/
- https://usn.ubuntu.com/4378-1/
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000656
- https://github.com/pallets/flask/pull/2691
- https://github.com/advisories/GHSA-562c-5r94-xh97
- https://github.com/pallets/flask/releases/tag/0.12.3
- https://lists.debian.org/debian-lts-announce/2019/08/msg00025.html
- https://github.com/pallets/flask/commit/b178e89e4456e777b1a7ac6d7199052d0dfdbbbe
- https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2018-66.yaml
- https://security.netapp.com/advisory/ntap-20190221-0001
- https://usn.ubuntu.com/4378-1
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more