tocsin

CVE-2023-30861

2 advisories.

PyPI/flask CVE-2023-30861: high 7.5, EPSS 1.26%

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

Action: Upgrade flask to 2.2.5 or later.

pip install flask==2.3.2
pip install flask==2.2.5

Affected

introducedfixedlast affected
2.3.02.3.2-
02.2.5-

Fixed versions

2.3.22.2.5

Sources

CVE-2023-30861 · published · modified · JSON

PyPI/flask CVE-2023-30861: unknown, EPSS 1.26%

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy

Action: Upgrade flask to 2.2.5 or later.

pip install flask==2.2.5
pip install flask==2.3.2

Affected

introducedfixedlast affected
02.2.5-
2.3.02.3.2-

Fixed versions

2.2.52.3.2

Sources

CVE-2023-30861 · published · modified · JSON