==========================================================================
Ubuntu Security Notice USN-6792-1
May 28, 2024

flask-security vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

Flask-Security could be made to bypass URL validation and redirect to 
arbitary URL.

Software Description:
- flask-security: Simple security for Flask apps (Python 3)

Details:

Naom Moshe discovered that Flask-Security incorrectly validated URLs. An 
attacker could use this issue to redirect users to arbitrary URLs.



Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
   python3-flask-security          4.0.0-1ubuntu0.1

Ubuntu 20.04 LTS
   python3-flask-security          1.7.5-2ubuntu0.20.04.1

Ubuntu 18.04 LTS
   python3-flask-security          1.7.5-2ubuntu0.18.04.1~esm1
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6792-1 

   CVE-2021-23385

Package Information:
https://launchpad.net/ubuntu/+source/flask-security/4.0.0-1ubuntu0.1 

https://launchpad.net/ubuntu/+source/flask-security/1.7.5-2ubuntu0.20.04.1 
 

Ubuntu 6792-1: Flask-Security Security Advisory Updates

May 28, 2024
Flask-Security could be made to bypass URL validation and redirect to arbitary URL.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Flask-Security could be made to bypass URL validation and redirect to arbitary URL. Software Description: - flask-security: Simple security for Flask apps (Python 3) Details: Naom Moshe discovered that Flask-Security incorrectly validated URLs. An attacker could use this issue to redirect users to arbitrary URLs.

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS   python3-flask-security          4.0.0-1ubuntu0.1 Ubuntu 20.04 LTS   python3-flask-security          1.7.5-2ubuntu0.20.04.1 Ubuntu 18.04 LTS   python3-flask-security          1.7.5-2ubuntu0.18.04.1~esm1                                   Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6792-1

  CVE-2021-23385

Severity
Ubuntu Security Notice USN-6792-1

Package Information

https://launchpad.net/ubuntu/+source/flask-security/4.0.0-1ubuntu0.1 https://launchpad.net/ubuntu/+source/flask-security/1.7.5-2ubuntu0.20.04.1

Related News