Debian 11: DLA-4197-1 critical: python-flask-cors risks with log injection

CVE-2024-1681

Due to a log injection vulnerability when the log level is set to
debug, an attacker can inject fake log entries into the log file by
sending a specially crafted GET request containing a CRLF sequence
in the request path.

CVE-2024-6839

An improper regex path matching vulnerability due to prioritizing
longer regex patterns over more specific ones when matching paths,
can lead to less restrictive CORS policies being applied to
sensitive endpoints.

CVE-2024-6844

An inconsistent CORS matching due to the handling of the '+'
character in URL paths leads to incorrect path normalization,
causing potential mismatches in CORS configuration.

CVE-2024-6866

The request path matching is case-insensitive. This results in a
mismatch because paths in URLs are case-sensitive. This
misconfiguration can lead to significant security vulnerabilities,
allowing unauthorized origins to access paths meant to be
restricted.