{"id":"CVE-2023-30861","aliases":["AZL-43798","AZL-44718","CLSA-2026-1772410250","CLSA-2026-1772410251","CLSA-2026-1772410252","CLSA-2026-1789986626","CLSA-2026-1789987201","DEBIAN-CVE-2023-30861","DLA-3536-1","DSA-5442-1","EUVD-2023-0080","GHSA-m2qf-hxjv-5gpq","MGASA-2023-0193","OESA-2023-1922","OESA-2023-1936","PYSEC-2023-62","RHSA-2023:3440","RHSA-2023:3444","RHSA-2023:3446","RHSA-2023:3525","RHSA-2023:3536","RHSA-2023:3541","RHSA-2023:3545","SUSE-SU-2023:2263-1","SUSE-SU-2023:2263-2","SUSE-SU-2023:2264-1","UBUNTU-CVE-2023-30861","USN-6111-1","openSUSE-SU-2024:12923-1","openSUSE-SU-2026:11902-1"],"status":"published","title":"Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header","description":"Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0125,"percentile":0.69814,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-539"],"published":"2023-05-01T19:22:20Z","modified":"2026-11-05T05:36:30Z","exploits":[{"source":"pocgithub","id":"fromitive/cve-2023-30861-poc","title":"fromitive/cve-2023-30861-poc","date":"2025-04-25","url":"https://github.com/fromitive/cve-2023-30861-poc"},{"source":"pocgithub","id":"elisapresciutti/CVE-2023-30861-flask-lab","title":"elisapresciutti/CVE-2023-30861-flask-lab","date":"2026-11-01","url":"https://github.com/elisapresciutti/CVE-2023-30861-flask-lab"}],"fixes":[{"ecosystem":"PyPI","package":"flask","fixed_in":["2.3.2","2.2.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"flask","fixed_in":["1.1.2.post1+tuxcare","1.1.4.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"flask","fixed_in":["2.2.2-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flask","fixed_in":["2.2.2-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flask","fixed_in":["2.2.2-3"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"flask","fixed_in":["1.0.2-3+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"flask","fixed_in":["1.1.2-2+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-flask","fixed_in":["1.1.2-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"python-flask","fixed_in":["1.1.2-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"python-flask","fixed_in":["1.1.2-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-flask","fixed_in":["2.1.2-4.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-flask","fixed_in":["2.1.2-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"python-flask","fixed_in":["2.1.2-4.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-flask","fixed_in":["1.1.2-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"python-flask","fixed_in":["1:1.1.2-6.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"python3-flask","fixed_in":["1:1.1.2-6.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python-flask","fixed_in":["1:1.0.2-8.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-flask","fixed_in":["1:1.0.2-8.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python-flask","fixed_in":["1:1.0.2-8.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-flask","fixed_in":["1:1.0.2-8.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"python-flask","fixed_in":["1:0.10.1-7.el7_9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-Flask","fixed_in":["1.0.4-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"python-Flask","fixed_in":["1.0.4-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-Flask","fixed_in":["1.0.4-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-Flask","fixed_in":["1.0.4-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-Flask","fixed_in":["1.0.2-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"flask","fixed_in":["1.1.1-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"flask","fixed_in":["2.0.1-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Flask","fixed_in":["3.1.3-3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.1-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.1-4"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.2"},{"fixed":"1.1.2.post1+tuxcare"}]}],"versions":["1.1.2"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.4"},{"fixed":"1.1.4.post1+tuxcare"}]}],"versions":["1.1.4"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.5"},{"fixed":"0.12.5.post2+tuxcare"}]}],"versions":["0.12.5","0.12.5.post1+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1"},{"fixed":"2.2.1.post2+tuxcare"}]}],"versions":["2.2.1","2.2.1.post1+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-3"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-3+deb10u1"}]}],"versions":["1.0.2-3"]},{"source":"osv","ecosystem":"Debian:11","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-2+deb11u1"}]}],"versions":["1.1.2-2"]},{"source":"osv","ecosystem":"PyPI","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.2"}]}],"versions":["2.3.0","2.3.1"]},{"source":"osv","ecosystem":"PyPI","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5"}]}],"versions":["0.1","0.10","0.10.1","0.11","0.11.1","0.12","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.2","0.3","0.3.1","0.4","0.5","0.5.1","0.5.2","0.6","0.6.1","0.7","0.7.1","0.7.2","0.8","0.8.1","0.9","1.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","2.0.0","2.0.0rc1","2.0.0rc2","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-4.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-4.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"flask","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"70f906c51ce49c485f1d355703e9cc3386b1cc2b"},{"fixed":"afd63b16170b7c047f5758eb910c416511e9c965"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5"},{"introduced":"2.3.0"},{"fixed":"2.3.2"}]}],"versions":["0.1","0.10","0.10.1","0.11","0.11.1","0.12","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.2","0.3","0.3.1","0.4","0.5","0.5.1","0.5.2","0.6","0.6.1","0.7","0.7.1","0.7.2","0.8","0.8.1","0.9","1.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","2.0.0","2.0.0rc1","2.0.0rc2","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.1"]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.2-6.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"python3-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.2-6.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2-8.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2-8.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2-8.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2-8.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.10.1-7.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.3-8.rhaos4.13.git9232b13.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.3-8.rhaos4.13.git9232b13.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.3-8.rhaos4.13.git9232b13.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.3-9.rhaos4.13.git9232b13.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.3-9.rhaos4.13.git9232b13.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.3-9.rhaos4.13.git9232b13.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305301841.p0.g148be47.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305301841.p0.g148be47.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-adsl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-adsl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-bluetooth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-bluetooth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-cloud-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-cloud-setup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-config-connectivity-redhat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-config-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-dispatcher-routing-rules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-initscripts-updown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-libnm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-libnm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-libnm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-ovs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-ppp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-team","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-team-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-tui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-tui-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-wifi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-wifi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-wwan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"NetworkManager-wwan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.2-2.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.7-1.1.rhaos4.13.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"conmon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.7-1.1.rhaos4.13.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"conmon-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.7-1.1.rhaos4.13.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305301841.p0.g148be47.assembly.stream.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305301841.p0.g148be47.assembly.stream.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.13::el9","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.0.1-4.el9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.13::el9","package":"python-flask-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.0.1-4.el9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.13::el9","package":"python3-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.0.1-4.el9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.5-5.rhaos4.11.git8bf967b.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.5-5.rhaos4.11.git8bf967b.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.5-5.rhaos4.11.git8bf967b.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.11::el8","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.2-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.11::el8","package":"python-flask-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.2-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.11::el8","package":"python3-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.2-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.0-4.1.rhaos4.12.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python-flask-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python3-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-2ubuntu0.1"}]}],"versions":["1.0.2-3","1.1.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-2ubuntu1.1"}]}],"versions":["1.1.2-2","2.0.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-2ubuntu0.1"}]}],"versions":["1.0.2-3","1.1.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-2ubuntu1.1"}]}],"versions":["1.1.2-2","2.0.1-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-3.1"}]}]}],"products":[{"vendor":"pallets","product":"flask"},{"vendor":"palletsprojects","product":"flask"}],"references":[{"url":"https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","article","report"]},{"url":"https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/pallets/flask/releases/tag/2.2.5","tags":["x_refsource_MISC","x_transferred","Release Notes","web","report"]},{"url":"https://github.com/pallets/flask/releases/tag/2.3.2","tags":["x_refsource_MISC","x_transferred","Release Notes","web","report"]},{"url":"https://www.debian.org/security/2023/dsa-5442","tags":["x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230818-0006/","tags":["x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00024.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30861","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2023-62.yaml","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20230818-0006","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m2qf-hxjv-5gpq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30861.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-30861","tags":["advisory"]},{"url":"https://github.com/pallets/flask","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0193.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31953","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-May/014935.html","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1922","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1936","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3440","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196643","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3440.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30861","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30861","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3444","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3444.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3446","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3446.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3525","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3525.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3536","tags":["advisory"]},{"url":"https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3536.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184483","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24534","tags":["advisory"]},{"url":"https://go.dev/issue/58975","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184482","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24536","tags":["advisory"]},{"url":"https://go.dev/issue/59153","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184484","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24537","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24537","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59180","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24538","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184481","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24538","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59234","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3541","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121632","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3541.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2995","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2995","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2995","tags":["advisory"]},{"url":"https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3545","tags":["advisory"]},{"url":"https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196027","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3545.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24540","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24540","tags":["advisory"]},{"url":"https://go.dev/issue/59721","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232263-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211246","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30861","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232263-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232264-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-30861","tags":["report"]},{"url":"https://github.com/pallets/flask/commit/8646edca6f47e2cd57464081b3911218d4734f8d","tags":["report"]},{"url":"https://github.com/pallets/flask/commit/8705dd39c4fa563ea0fe0bf84c85da8fcc98b88d","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6111-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-30861","title":"Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header","description":"Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.","status":"published","published":"2023-05-02T17:04:22.197Z","modified":"2025-02-13T16:49:37.977Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-539"],"updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2023-0080","description":"Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.","status":"published","published":"2023-05-02T17:04:22Z","modified":"2025-02-13T16:49:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:03:50.947767Z"}],"ghsa":[{"id":"GHSA-m2qf-hxjv-5gpq","title":"Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header","description":"When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent).\n2. The application does not access or modify the session at any point during a request.\n4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.","status":"published","published":"2023-05-01T19:22:20Z","modified":"2024-09-20T17:51:02Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-539"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2023-30861","description":"Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.","status":"published","published":"2023-05-02T18:15:52.373Z","modified":"2026-06-17T05:55:47.853Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-539"],"updated_at":"2026-11-02T14:07:59.151142Z"}],"osv":[{"id":"AZL-43798","title":"CVE-2023-30861 affecting package python-flask 1.1.1-4","description":"Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.","status":"published","published":"2023-05-02T18:15:52Z","modified":"2026-04-21T04:31:09.585195Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44718","title":"CVE-2023-30861 affecting package python-flask 1.1.1-4","description":"Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.","status":"published","published":"2023-05-02T18:15:52Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2023-30861","title":"Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header","description":"Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.","status":"published","published":"2023-05-02T17:04:22.197Z","modified":"2026-10-28T02:30:37.456013055Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-539"],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"DEBIAN-CVE-2023-30861","description":"Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.  This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.","status":"published","published":"2023-05-02T18:15:52.373Z","modified":"2026-10-26T18:01:04.166483729Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"GHSA-m2qf-hxjv-5gpq","title":"Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header","description":"When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent).\n2. The application does not access or modify the session at any point during a request.\n4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.","status":"published","published":"2023-05-01T19:22:20Z","modified":"2026-09-10T03:50:01.763387498Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-539"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"OESA-2023-1922","title":"python-flask security update","description":"Flask is a lightweight WSGI web application framework. It is designed to make getting started quick and easy, with the ability to scale up to complex applications. It began as a simple wrapper around Werkzeug and Jinja and has become one of the most popular Python web application frameworks.\r\n\r\nSecurity Fix(es):\r\n\r\nFlask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client\u0026apos;s `session` cookie to other clients. The severity depends on the application\u0026apos;s use of the session and the proxy\u0026apos;s behavior regarding cookies. The risk depends on all these conditions being met.\r\n\r\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\r\n\r\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.(CVE-2023-30861)","status":"published","published":"2023-12-15T11:06:22Z","modified":"2026-08-18T01:18:05.573131031Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1936","title":"python-flask security update","description":"Flask is a lightweight WSGI web application framework. It is designed to make getting started quick and easy, with the ability to scale up to complex applications. It began as a simple wrapper around Werkzeug and Jinja and has become one of the most popular Python web application frameworks.\r\n\r\nSecurity Fix(es):\r\n\r\nFlask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client\u0026apos;s `session` cookie to other clients. The severity depends on the application\u0026apos;s use of the session and the proxy\u0026apos;s behavior regarding cookies. The risk depends on all these conditions being met.\r\n\r\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\r\n\r\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.(CVE-2023-30861)","status":"published","published":"2023-12-22T11:06:23Z","modified":"2026-08-18T01:18:06.397224762Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2023:3440","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-flask) security update","status":"published","published":"2024-09-13T18:48:10Z","modified":"2026-07-03T10:03:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3444","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-flask) security update","status":"published","published":"2024-09-13T18:48:00Z","modified":"2026-07-03T10:03:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3446","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (python-flask) security update","status":"published","published":"2024-09-13T18:47:50Z","modified":"2026-07-03T10:03:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3525","title":"Red Hat Security Advisory: python-flask security update","status":"published","published":"2024-09-13T18:47:23Z","modified":"2026-07-03T10:03:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3536","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.3 packages and security update","status":"published","published":"2024-09-30T14:48:10Z","modified":"2026-10-16T10:02:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3541","title":"Red Hat Security Advisory: OpenShift Container Platform 4.11.43 packages and security update","status":"published","published":"2024-09-16T09:36:35Z","modified":"2026-07-03T10:03:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3545","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.21 packages and security update","status":"published","published":"2024-09-30T09:49:05Z","modified":"2026-10-16T10:02:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"UBUNTU-CVE-2023-30861","description":"Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.","status":"published","published":"2023-05-02T18:15:00Z","modified":"2026-02-04T03:30:19.269204Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"CLSA-2026-1772410250","title":"TuxCare security update for flask (1 CVE)","description":"TuxCare rebuilt flask to address 1 CVE. Fixed in 1.1.2.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:47:42.007205998Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1772410251","title":"TuxCare security update for flask (1 CVE)","description":"TuxCare rebuilt flask to address 1 CVE. Fixed in 1.1.4.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:47:42.011760748Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1772410252","title":"TuxCare security update for flask (1 CVE)","description":"TuxCare rebuilt flask to address 1 CVE. Fixed in 2.2.1.post1+tuxcare.","status":"withdrawn","published":"2026-08-04T14:52:08Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1789986626","title":"TuxCare security update for flask (2 CVEs)","description":"TuxCare rebuilt flask to address 2 CVEs. Fixed in 0.12.5.post2+tuxcare.","status":"published","published":"2026-09-21T10:30:25Z","modified":"2026-10-15T09:48:01.79984282Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789987201","title":"TuxCare security update for flask (2 CVEs)","description":"TuxCare rebuilt flask to address 2 CVEs. Fixed in 2.2.1.post2+tuxcare.","status":"published","published":"2026-09-21T10:40:01Z","modified":"2026-10-15T09:48:01.765865819Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"DLA-3536-1","title":"flask - security update","status":"published","published":"2023-08-20T00:00:00Z","modified":"2026-03-09T01:20:52.27576Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5442-1","title":"flask - security update","status":"published","published":"2023-06-29T00:00:00Z","modified":"2026-03-09T02:09:40.782368Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0193","title":"Updated python-flask packages fix security vulnerability","description":"Client 'session' cookie sent to other clients (CVE-2023-30861)\n","status":"published","published":"2023-06-08T19:34:59Z","modified":"2026-04-16T04:42:48.877615237Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12923-1","title":"python310-Flask-2.2.5-1.1 on GA media","description":"These are all security issues fixed in the python310-Flask-2.2.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:48.849522Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2026:11902-1","title":"python313-Flask-3.1.3-3.1 on GA media","description":"These are all security issues fixed in the python313-Flask-3.1.3-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-28T00:00:00Z","modified":"2026-09-29T18:23:22.769208877Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2023-62","description":"Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets `session.permanent = True`\n3. The application does not access or modify the session at any point during a request.\n4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.","status":"published","published":"2023-05-02T18:15:00Z","modified":"2023-11-08T04:12:28.231927Z","updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"SUSE-SU-2023:2263-1","title":"Security update for python-Flask","description":"This update for python-Flask fixes the following issues:\n\n- CVE-2023-30861: Fixed a potential cookie confusion due to incorrect\n  caching (bsc#1211246).\n","status":"published","published":"2023-05-22T10:16:24Z","modified":"2026-02-04T02:57:54.368476Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2263-2","title":"Security update for python-Flask","description":"This update for python-Flask fixes the following issues:\n\n- CVE-2023-30861: Fixed a potential cookie confusion due to incorrect\n  caching (bsc#1211246).\n","status":"published","published":"2023-07-20T11:55:31Z","modified":"2026-02-04T03:15:10.28911Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2264-1","title":"Security update for python-Flask","description":"This update for python-Flask fixes the following issues:\n\n- CVE-2023-30861: Fixed a potential cookie confusion due to incorrect\n  caching (bsc#1211246).\n","status":"published","published":"2023-05-22T10:21:27Z","modified":"2026-02-04T04:23:44.246086Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-6111-1","title":"flask vulnerability","description":"It was discovered that Flask incorrectly handled certain data responses.\nAn attacker could possibly use this issue to expose sensitive information.\n","status":"published","published":"2023-05-29T12:12:21Z","modified":"2026-02-10T04:43:08Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}