Alerts This Week
Warning Icon 1 562
Alerts This Week
Warning Icon 1 562

Stay Secure with the Latest Linux Advisories

Filter Icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 7 articles for you...
87

Ubuntu: USN-5439-1 Moderate: Flask Session Cookie Vulnerability

It was discovered that in some conditions the Flask web framework may disclose a session cookie. For the oldstable distribution (bullseye), this problem has been fixed . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5442-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Moritz Muehlenhoff June 29, 2023 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : flask CVE ID : CVE-2023-30861 It was discovered that in some conditions the Flask web framework may disclose a session cookie. For the oldstable distribution (bullseye), this problem has been fixed in version 1.1.2-2+deb11u1. We recommend that you upgrade your flask packages. For the detailed security status of flask please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/flask Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . A vulnerability in Flask has been identified that could leak session cookies on Debian systems. It's advisable to update your Flask packages to enhance security.. Flask Framework, Debian Security, Session Protection. . LinuxSecurity.com Team

Calendar 2 Jun 29, 2023 Debian
98

Red Hat OpenShift 4.13.3 RHSA-2023:3536-01 Critical: Flask Cookie Issue

Red Hat OpenShift Container Platform release 4.13.3 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: OpenShift Container Platform 4.13.3 packages and security update Advisory ID: RHSA-2023:3536-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2023:3536 Issue date: 2023-06-13 CVE Names: CVE-2023-30861 ==================================================================== 1. Summary: Red Hat OpenShift Container Platform release 4.13.3 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of [impact]. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Ironic content for Red Hat OpenShift Container Platform 4.13 - noarch Red Hat OpenShift Container Platform 4.13 - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.3. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2023:3537 Security Fix(es): * flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header (CVE-2023-30861) For more details about thesecurity issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/updating_clusters/updating-cluster-cli 4. Solution: For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes/ocp-4-13-release-notes 5. Bugs fixed (https://bugzilla.redhat.com/): 2196643 - CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header 6. Package List: Red Hat OpenShift Container Platform4.13: Source: cri-o-1.26.3-8.rhaos4.13.git9232b13.el8.src.rpm openshift-4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8.src.rpm openshift-ansible-4.13.0-202305301841.p0.g148be47.assembly.stream.el8.src.rpm openshift-clients-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8.src.rpm aarch64: cri-o-1.26.3-8.rhaos4.13.git9232b13.el8.aarch64.rpm cri-o-debuginfo-1.26.3-8.rhaos4.13.git9232b13.el8.aarch64.rpm cri-o-debugsource-1.26.3-8.rhaos4.13.git9232b13.el8.aarch64.rpm openshift-clients-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8.aarch64.rpm openshift-hyperkube-4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8.aarch64.rpm noarch: openshift-ansible-4.13.0-202305301841.p0.g148be47.assembly.stream.el8.noarch.rpm openshift-ansible-test-4.13.0-202305301841.p0.g148be47.assembly.stream.el8.noarch.rpm ppc64le: cri-o-1.26.3-8.rhaos4.13.git9232b13.el8.ppc64le.rpm cri-o-debuginfo-1.26.3-8.rhaos4.13.git9232b13.el8.ppc64le.rpm cri-o-debugsource-1.26.3-8.rhaos4.13.git9232b13.el8.ppc64le.rpm openshift-clients-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8.ppc64le.rpm openshift-hyperkube-4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8.ppc64le.rpm s390x: cri-o-1.26.3-8.rhaos4.13.git9232b13.el8.s390x.rpm cri-o-debuginfo-1.26.3-8.rhaos4.13.git9232b13.el8.s390x.rpm cri-o-debugsource-1.26.3-8.rhaos4.13.git9232b13.el8.s390x.rpm openshift-clients-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8.s390x.rpm openshift-hyperkube-4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8.s390x.rpm x86_64: cri-o-1.26.3-8.rhaos4.13.git9232b13.el8.x86_64.rpm cri-o-debuginfo-1.26.3-8.rhaos4.13.git9232b13.el8.x86_64.rpm cri-o-debugsource-1.26.3-8.rhaos4.13.git9232b13.el8.x86_64.rpm openshift-clients-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8.x86_64.rpm openshift-clients-redistributable-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8.x86_64.rpm openshift-hyperkube-4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8.x86_64.rpm Red Hat OpenShift Container Platform4.13: Source: NetworkManager-1.42.2-2.el9_2.src.rpm conmon-2.1.7-1.1.rhaos4.13.el9.src.rpm cri-o-1.26.3-9.rhaos4.13.git9232b13.el9.src.rpm openshift-4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9.src.rpm openshift-ansible-4.13.0-202305301841.p0.g148be47.assembly.stream.el9.src.rpm openshift-clients-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9.src.rpm aarch64: NetworkManager-1.42.2-2.el9_2.aarch64.rpm NetworkManager-adsl-1.42.2-2.el9_2.aarch64.rpm NetworkManager-adsl-debuginfo-1.42.2-2.el9_2.aarch64.rpm NetworkManager-bluetooth-1.42.2-2.el9_2.aarch64.rpm NetworkManager-bluetooth-debuginfo-1.42.2-2.el9_2.aarch64.rpm NetworkManager-cloud-setup-1.42.2-2.el9_2.aarch64.rpm NetworkManager-cloud-setup-debuginfo-1.42.2-2.el9_2.aarch64.rpm NetworkManager-debuginfo-1.42.2-2.el9_2.aarch64.rpm NetworkManager-debugsource-1.42.2-2.el9_2.aarch64.rpm NetworkManager-libnm-1.42.2-2.el9_2.aarch64.rpm NetworkManager-libnm-debuginfo-1.42.2-2.el9_2.aarch64.rpm NetworkManager-libnm-devel-1.42.2-2.el9_2.aarch64.rpm NetworkManager-ovs-1.42.2-2.el9_2.aarch64.rpm NetworkManager-ovs-debuginfo-1.42.2-2.el9_2.aarch64.rpm NetworkManager-ppp-1.42.2-2.el9_2.aarch64.rpm NetworkManager-ppp-debuginfo-1.42.2-2.el9_2.aarch64.rpm NetworkManager-team-1.42.2-2.el9_2.aarch64.rpm NetworkManager-team-debuginfo-1.42.2-2.el9_2.aarch64.rpm NetworkManager-tui-1.42.2-2.el9_2.aarch64.rpm NetworkManager-tui-debuginfo-1.42.2-2.el9_2.aarch64.rpm NetworkManager-wifi-1.42.2-2.el9_2.aarch64.rpm NetworkManager-wifi-debuginfo-1.42.2-2.el9_2.aarch64.rpm NetworkManager-wwan-1.42.2-2.el9_2.aarch64.rpm NetworkManager-wwan-debuginfo-1.42.2-2.el9_2.aarch64.rpm conmon-2.1.7-1.1.rhaos4.13.el9.aarch64.rpm conmon-debuginfo-2.1.7-1.1.rhaos4.13.el9.aarch64.rpm conmon-debugsource-2.1.7-1.1.rhaos4.13.el9.aarch64.rpm cri-o-1.26.3-9.rhaos4.13.git9232b13.el9.aarch64.rpm cri-o-debuginfo-1.26.3-9.rhaos4.13.git9232b13.el9.aarch64.rpm cri-o-debugsource-1.26.3-9.rhaos4.13.git9232b13.el9.aarch64.rpm openshift-clients-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9.aarch64.rpm openshift-hyperkube-4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9.aarch64.rpm noarch: NetworkManager-config-connectivity-redhat-1.42.2-2.el9_2.noarch.rpm NetworkManager-config-server-1.42.2-2.el9_2.noarch.rpm NetworkManager-dispatcher-routing-rules-1.42.2-2.el9_2.noarch.rpm NetworkManager-initscripts-updown-1.42.2-2.el9_2.noarch.rpm openshift-ansible-4.13.0-202305301841.p0.g148be47.assembly.stream.el9.noarch.rpm openshift-ansible-test-4.13.0-202305301841.p0.g148be47.assembly.stream.el9.noarch.rpm ppc64le: NetworkManager-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-adsl-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-adsl-debuginfo-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-bluetooth-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-bluetooth-debuginfo-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-cloud-setup-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-cloud-setup-debuginfo-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-debuginfo-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-debugsource-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-libnm-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-libnm-debuginfo-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-libnm-devel-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-ovs-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-ovs-debuginfo-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-ppp-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-ppp-debuginfo-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-team-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-team-debuginfo-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-tui-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-tui-debuginfo-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-wifi-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-wifi-debuginfo-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-wwan-1.42.2-2.el9_2.ppc64le.rpm NetworkManager-wwan-debuginfo-1.42.2-2.el9_2.ppc64le.rpm conmon-2.1.7-1.1.rhaos4.13.el9.ppc64le.rpm conmon-debuginfo-2.1.7-1.1.rhaos4.13.el9.ppc64le.rpm conmon-debugsource-2.1.7-1.1.rhaos4.13.el9.ppc64le.rpm cri-o-1.26.3-9.rhaos4.13.git9232b13.el9.ppc64le.rpm cri-o-debuginfo-1.26.3-9.rhaos4.13.git9232b13.el9.ppc64le.rpm cri-o-debugsource-1.26.3-9.rhaos4.13.git9232b13.el9.ppc64le.rpm openshift-clients-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9.ppc64le.rpm openshift-hyperkube-4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9.ppc64le.rpm s390x: NetworkManager-1.42.2-2.el9_2.s390x.rpm NetworkManager-adsl-1.42.2-2.el9_2.s390x.rpm NetworkManager-adsl-debuginfo-1.42.2-2.el9_2.s390x.rpm NetworkManager-bluetooth-1.42.2-2.el9_2.s390x.rpm NetworkManager-bluetooth-debuginfo-1.42.2-2.el9_2.s390x.rpm NetworkManager-cloud-setup-1.42.2-2.el9_2.s390x.rpm NetworkManager-cloud-setup-debuginfo-1.42.2-2.el9_2.s390x.rpm NetworkManager-debuginfo-1.42.2-2.el9_2.s390x.rpm NetworkManager-debugsource-1.42.2-2.el9_2.s390x.rpm NetworkManager-libnm-1.42.2-2.el9_2.s390x.rpm NetworkManager-libnm-debuginfo-1.42.2-2.el9_2.s390x.rpm NetworkManager-libnm-devel-1.42.2-2.el9_2.s390x.rpm NetworkManager-ovs-1.42.2-2.el9_2.s390x.rpm NetworkManager-ovs-debuginfo-1.42.2-2.el9_2.s390x.rpm NetworkManager-ppp-1.42.2-2.el9_2.s390x.rpm NetworkManager-ppp-debuginfo-1.42.2-2.el9_2.s390x.rpm NetworkManager-team-1.42.2-2.el9_2.s390x.rpm NetworkManager-team-debuginfo-1.42.2-2.el9_2.s390x.rpm NetworkManager-tui-1.42.2-2.el9_2.s390x.rpm NetworkManager-tui-debuginfo-1.42.2-2.el9_2.s390x.rpm NetworkManager-wifi-1.42.2-2.el9_2.s390x.rpm NetworkManager-wifi-debuginfo-1.42.2-2.el9_2.s390x.rpm NetworkManager-wwan-1.42.2-2.el9_2.s390x.rpm NetworkManager-wwan-debuginfo-1.42.2-2.el9_2.s390x.rpm conmon-2.1.7-1.1.rhaos4.13.el9.s390x.rpm conmon-debuginfo-2.1.7-1.1.rhaos4.13.el9.s390x.rpm conmon-debugsource-2.1.7-1.1.rhaos4.13.el9.s390x.rpm cri-o-1.26.3-9.rhaos4.13.git9232b13.el9.s390x.rpm cri-o-debuginfo-1.26.3-9.rhaos4.13.git9232b13.el9.s390x.rpm cri-o-debugsource-1.26.3-9.rhaos4.13.git9232b13.el9.s390x.rpm openshift-clients-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9.s390x.rpm openshift-hyperkube-4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9.s390x.rpm x86_64: NetworkManager-1.42.2-2.el9_2.x86_64.rpm NetworkManager-adsl-1.42.2-2.el9_2.x86_64.rpm NetworkManager-adsl-debuginfo-1.42.2-2.el9_2.x86_64.rpm NetworkManager-bluetooth-1.42.2-2.el9_2.x86_64.rpm NetworkManager-bluetooth-debuginfo-1.42.2-2.el9_2.x86_64.rpm NetworkManager-cloud-setup-1.42.2-2.el9_2.x86_64.rpm NetworkManager-cloud-setup-debuginfo-1.42.2-2.el9_2.x86_64.rpm NetworkManager-debuginfo-1.42.2-2.el9_2.x86_64.rpm NetworkManager-debugsource-1.42.2-2.el9_2.x86_64.rpm NetworkManager-libnm-1.42.2-2.el9_2.x86_64.rpm NetworkManager-libnm-debuginfo-1.42.2-2.el9_2.x86_64.rpm NetworkManager-libnm-devel-1.42.2-2.el9_2.x86_64.rpm NetworkManager-ovs-1.42.2-2.el9_2.x86_64.rpm NetworkManager-ovs-debuginfo-1.42.2-2.el9_2.x86_64.rpm NetworkManager-ppp-1.42.2-2.el9_2.x86_64.rpm NetworkManager-ppp-debuginfo-1.42.2-2.el9_2.x86_64.rpm NetworkManager-team-1.42.2-2.el9_2.x86_64.rpm NetworkManager-team-debuginfo-1.42.2-2.el9_2.x86_64.rpm NetworkManager-tui-1.42.2-2.el9_2.x86_64.rpm NetworkManager-tui-debuginfo-1.42.2-2.el9_2.x86_64.rpm NetworkManager-wifi-1.42.2-2.el9_2.x86_64.rpm NetworkManager-wifi-debuginfo-1.42.2-2.el9_2.x86_64.rpm NetworkManager-wwan-1.42.2-2.el9_2.x86_64.rpm NetworkManager-wwan-debuginfo-1.42.2-2.el9_2.x86_64.rpm conmon-2.1.7-1.1.rhaos4.13.el9.x86_64.rpm conmon-debuginfo-2.1.7-1.1.rhaos4.13.el9.x86_64.rpm conmon-debugsource-2.1.7-1.1.rhaos4.13.el9.x86_64.rpm cri-o-1.26.3-9.rhaos4.13.git9232b13.el9.x86_64.rpm cri-o-debuginfo-1.26.3-9.rhaos4.13.git9232b13.el9.x86_64.rpm cri-o-debugsource-1.26.3-9.rhaos4.13.git9232b13.el9.x86_64.rpm openshift-clients-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9.x86_64.rpm openshift-clients-redistributable-4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9.x86_64.rpm openshift-hyperkube-4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9.x86_64.rpm Ironic content for Red Hat OpenShift Container Platform 4.13: Source: python-flask-2.0.1-4.el9.2.src.rpm noarch: python-flask-doc-2.0.1-4.el9.2.noarch.rpm python3-flask-2.0.1-4.el9.2.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are availablefrom https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2023-30861 https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes/ocp-4-13-release-notes 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZIlEuNzjgjWX9erEAQhzZw//dt8uX+TXD7vD7cyQwgzBw8K+7q/ZGx+/ iXzS5+ZmpJSnKgRpXjIDdWuErCxmaG3XNEla9VCNSY5tqrLLXA0tbA9IhiMFxutf uft7Qx/29UA7ROKSGBGT9Se2qP+3QC3E10vFYQ4OUqc+36fjoZF+EcxshkG3nQwh j9YaEnN2u10zz5OG19kJD2yfFF6bkc2Zk0twIX7B/xh4U7UObzzsDe9MrWtCRsqr AikryJs6Is7PnGPsfEQb7ZbeuaIkN74QoXTpO7+bsuTgIZMxnQXv7EaoB7JULAmT j/g0o1caIuC+MKkQTXQPPXnVzhrsQnEPo7oUYW+X1xFbXT+Nol46gnNSvetIeoAw YF9WwDEdHS3bQs8Rk+FsTPhGhnJ8cpPlmfDjkOFiWsxshDNULEGrHVMfT0CW2GaZ NP3En6nHsI4tbE/Ad4EFOmcSjTlwualSLLk6lgmh6ySbS9mZ4cy4JoBep8/VfajJ 2pWjLuQRlnTqflu9j0Pkcx19ZGRsUC3gYLUsRyD/Zu1+kUSMVy3Cl44YYZUiqAjN 13iWnZguP1rbVJSIz4sjC/MqHMBYeyv7lx8iLzx7RZsrWTbCW1ueYsW63XIjI0TD Robwqlz69Tge3t338Z6FArsFXZCKqAdPwhyQr490kcTkSNc/POp9AR4VkAnPpJxe 0I6IQfiKXeo=MVJf -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Discover vital updates for Red Hat OpenShift 4.13.3, including a critical flask cookie issue and security enhancements.. OpenShift 4.13.3, security update, Critical Severity, OpenShift Container. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Jun 14, 2023 Critical Red Hat
203

Mageia 8: 2023-0193 Critical: Python-Flask Session Cookie Exposure

Client 'session' cookie sent to other clients (CVE-2023-30861) References: - https://bugs.mageia.org/show_bug.cgi?id=31953 - https://lists.suse.com/pipermail/sle-security-updates/2023-May/014935.html . MGASA-2023-0193 - Updated python-flask packages fix security vulnerability Publication date: 08 Jun 2023 URL: https://advisories.mageia.org/MGASA-2023-0193.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-30861 Client 'session' cookie sent to other clients (CVE-2023-30861) References: - https://bugs.mageia.org/show_bug.cgi?id=31953 - https://lists.suse.com/pipermail/sle-security-updates/2023-May/014935.html - https://www.cve.org/CVERecord?id=CVE-2023-30861 SRPMS: - 8/core/python-flask-1.1.2-1.1.mga8 . Mageia 2023-0194 reveals an essential python-flask security patch mitigating potential client token leakage. Discover more!. Mageia Python-Flask Update, Security Cookie Issue, Authentication Flaw. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Jun 08, 2023 Critical Mageia
98

Red Hat: RHSA-2023:3525 Critical: Python Flask Session Cookie Risk

An update for python-flask is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: python-flask security update Advisory ID: RHSA-2023:3525-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://access.redhat.com/errata/RHSA-2023:3525 Issue date: 2023-06-07 CVE Names: CVE-2023-30861 ==================================================================== 1. Summary: An update for python-flask is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux 7 Extras - noarch 3. Description: Flask is a lightweight but extensible web development framework for Python based on the Werkzeug WSGI toolkit, and the Jinja 2 template engine. Security Fix(es): * flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header (CVE-2023-30861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2196643 - CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header 6. Package List: Red Hat Enterprise Linux 7Extras: Source: python-flask-0.10.1-7.el7_9.src.rpm noarch: python-flask-0.10.1-7.el7_9.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-30861 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZIBw+tzjgjWX9erEAQjDww//S0Ay3p4qP1Fgqkw8/bD8nMc9QtBH6bRo McQKI/qOpSg7l4qqX4/Dlvos2r1CElc0LboTyzJ0J3shx+klVfUmXLrfYgSs7Jw3 /ooZxJjutrdkvgez3norOuHQFqb418AUqmLSH2fDYtFNXlZyqSs08eo3xOsQf7N+ FdPii6tMuiSUHdAj4yhBzp60ThBCm6CNyVFQfjZSKTNDDwuoB3zZIdWpIDz2lxtd yAjLCMKGw4kHLmGO+c4OXEhHK4vbUqk6+3xuJ4elzc90seEodI61c88To6DUe4L3 BrZlfr3hugFefyl4wzRUYvSA9iJLmzdwbHUYpAQHZ90C2X63it66sEw3pdrflV80 yj/0Gz8iVL/SHXAyeSj5AEIBmsegCCwZZvZnFufUQptZBioAAQbNCSPYH2WXLVLL XBfSlLTPYd6Xo6bIQ3xFAdqEEKiaQ+vykOaUkYYEcXdE06CYcApLm+B6nZdJrSTd WvCy1G82DMEXNtAwrhULCcVHJOfx8v9xWKiKT71ipYvzj1MR2vvdnIuxbEfYHoiv TbVgX08ixx+vyd+w0rHJmWIe96Gyzy1LzGa0xEzyNVJLv1yz50TAVaJq3A8bkKuD zk93nnlEA9WGuc11313bG2QwLRu/wJUeoRy7TzyMIkTB9Es+Um6PgdbEGna0hHZ5 tmpg/ZT8uAU=P970 -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Crucial security patch released for python-flask on Red Hat, addressing severe risk of session cookie leakage. Immediate upgrade recommended.. python-flask update, Red Hat security, web application risks. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Jun 07, 2023 Important Red Hat
98

Red Hat 17.0 RHSA-2023:3440-01 Important: Session Cookie Issue

An update for python-flask is now available for Red Hat OpenStack Platform 17.0 (Wallaby). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenStack Platform 17.0 (python-flask) security update Advisory ID: RHSA-2023:3440-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2023:3440 Issue date: 2023-06-05 CVE Names: CVE-2023-30861 ==================================================================== 1. Summary: An update for python-flask is now available for Red Hat OpenStack Platform 17.0 (Wallaby). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 17.0 - noarch 3. Description: Flask is called a “micro-framework” because the idea to keep the core simple but extensible. There is no database abstraction layer, no form validation or anything else where different libraries already exist that can handle that. However Flask knows the concept of extensions that can add this functionality into your application as if it was implemented in Flask itself. There are currently extensions for object relational mappers, form validation, upload handling, various open authentication technologies and more. Security Fix(es): * Possible disclosure of permanent session cookie due to missing Vary: Cookie header (CVE-2023-30861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to theCVE page listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2196643 - CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header 6. Package List: Red Hat OpenStack Platform 17.0: Source: python-flask-1.1.2-6.el9ost.src.rpm noarch: python3-flask-1.1.2-6.el9ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-30861 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZH538dzjgjWX9erEAQhxqg/8DysCxcTh0YuNH19oiiaAi/7+77JHXXou FPeUpkKfeif2eWiAm4wJHKMLEOSQnFsgfEJcAk0bopl8OiANMV6d7e7/IH3mV5Eo ENEpzSa73CcB0ZGhk7DWa7mFh22nevh4a5a8wKU+PPEF4eHnIJzzl9K2hBvAwpZ/ D2oM3Z0UrtGJPw+2xbqSgJfaIubKhm4PZSgLnL92k6XmuPrVxTyDPrvrtfXjXgaU e9fjoMTO/Z0lotdFSZUyBJSNOKwoI3CTo/XZAfzv9FRyLVtiyP1CpUnvuHZqQKzs dqRjDBNtt0YU8d6koT/WhXHePf4HUndpScoypjoBFtTr0VAZIN3meGjjsv7f0x3b bc8Li7ARUmGS91canC0q+AX1POyJUnLj4clv3gDPFk/qlY9xg6kgt8r4Yl9hSI7O fDVS/f/L+4fZ+0QK+V4lDxzf7b9pFLbofTIDm3SvuNvIYjgb2I49CVCkpJqCNdzL HPywLWSsBRGcFeklDPlgOmTJ9y/U9y+e9/4GgZr42Y8MG+bUhq/eOoXa4zmmSh0N t9Kuy4bNMFcqHJvyGWTNS87uXE+jRhsg6W3iFwwrEQrc2IrQ10+/PKewWkqZgCTd ZtYgaIBaqlLVfrJEjkjKsIUhQGCAOEmqUnMsz5eY3Dja6NoPQziekHmwcJDZIDTi o0D9zApP3T8=OFiY -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . A critical software patch has been released for Red Hat OpenStack 17.0 that resolves a vulnerability related to session token leakage.. Red Hat OpenStack, Python Flask, Security Update, CookieDisclosure Issue, Important Advisory. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Jun 06, 2023 Important Red Hat
98

Red Hat OpenStack 16.2: RHSA-2023-3444 Important: python-flask Session Risk

An update for python-flask is now available for Red Hat OpenStack Platform 16.2 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenStack Platform 16.2 (python-flask) security update Advisory ID: RHSA-2023:3444-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2023:3444 Issue date: 2023-06-05 CVE Names: CVE-2023-30861 ==================================================================== 1. Summary: An update for python-flask is now available for Red Hat OpenStack Platform 16.2 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 16.2 - noarch 3. Description: Flask is called a “micro-framework” because the idea to keep the core simple but extensible. There is no database abstraction layer, no form validation or anything else where different libraries already exist that can handle that. However Flask knows the concept of extensions that can add this functionality into your application as if it was implemented in Flask itself. There are currently extensions for object relational mappers, form validation, upload handling, various open authentication technologies and more. Security Fix(es): * Possible disclosure of permanent session cookie due to missing Vary: Cookie header (CVE-2023-30861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to theCVE page listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2196643 - CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header 6. Package List: Red Hat OpenStack Platform 16.2: Source: python-flask-1.0.2-8.el8ost.src.rpm noarch: python3-flask-1.0.2-8.el8ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-30861 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZH537NzjgjWX9erEAQhb1A//Qfz5x8mNLdNmdb0wcsAZBycpQxytYopx qzQvijFJ/sB7xLEFi0KflSq5vW6DQWJInHPgw93byddP5KkK1NgbnBGpaMfQJ0zL nBZ4pjWNVWUrJuDyQSzB5Q1Oy/sg8gfDDcyW4zvmaWtXdqxG69iEYKcMxkN8Jmkz LmdI13dIPsbV8rTmMMv3/U/s5UyQhr3gyEWyVXlVIs1lTCDl8EslMWXgvnvMbyFH 7jIWwQrNnncM3QyoWLnUiLjkuKzlIYMbJ15Zy5Wog9/zC6pZdd+vrTSHU1xHtKGL 24OTtP+vtsKsSUSaKburNkUNW9DI5irsUHTj3mBFYenXif3vC11xNTk47nR5Y08W ICXUUFpLNMdN56G5cNMWlWVDL/bB5rqcj1hA24PWw47foHRTusOmqSOnLsIqkOHd eF7Wa56cV9NBNYU8ptkvyim6diqWHlaizLYy0+u3CNECo9na4RbNsCpjYkwlS8xN 2I7xbje1sOYp/ZfVEivExPDFcbP2v2W9W4pSe5pwMAgPGFVzYT2+NFDvuM2EwmYZ ldvhYCC2m52PJEmP6Ln7+W+3qHsPFukFRku2vStbx80/aU5oS9qwvpleXm6kFIEu IL09wFXO2kqW3Kq4Y/2KVWwS2d2k+HG8ULaMjZKHJHZ3kEmFSvvXONXJIFG3zY5v i7BbHWKANm4=rTee -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . The recent launch of Red Hat OpenStack Platform 16.2 has issued a crucial security patch for python-flask, targeting a significant vulnerability concerning session cookies.. Red Hat OpenStack,python-flask update, important security fix. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Jun 06, 2023 Important Red Hat
98

Red Hat OpenStack 16.1 RHSA-2023-3446 Important: Session Cookie Disclosure

An update for python-flask is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenStack Platform 16.1 (python-flask) security update Advisory ID: RHSA-2023:3446-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2023:3446 Issue date: 2023-06-05 CVE Names: CVE-2023-30861 ==================================================================== 1. Summary: An update for python-flask is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 16.1 - noarch 3. Description: Flask is called a “micro-framework” because the idea to keep the core simple but extensible. There is no database abstraction layer, no form validation or anything else where different libraries already exist that can handle that. However Flask knows the concept of extensions that can add this functionality into your application as if it was implemented in Flask itself. There are currently extensions for object relational mappers, form validation, upload handling, various open authentication technologies and more. Security Fix(es): * Possible disclosure of permanent session cookie due to missing Vary: Cookie header (CVE-2023-30861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to theCVE page listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2196643 - CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header 6. Package List: Red Hat OpenStack Platform 16.1: Source: python-flask-1.0.2-8.el8ost.src.rpm noarch: python3-flask-1.0.2-8.el8ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-30861 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZH53pdzjgjWX9erEAQg8lw//b6uYgkWJ7vu0404JVWDmPmw4+UolL/Ne ugFYxIvCEsj7aBcv7hcUT/AzFbKSC+kmG2LPgNmXPxmoyxgvtmX5cmfJ3I2yx62r DleLwfKkmaPYFOQHu2EZEHUu+UrwMqQwOLm5Q+dZbfMuToZYGdG7k8ygKYbONK4l xzvYKHyyOYV6/sjO23qTgZMWl1OUibKJWcK0jmbw0W5uwZrbdLDy78i35Z9Lzmwz cAUF3SofkV3V2DizB2zIQ+WVyajdPtW3awOHu5Ss0Pf50e7rWuieuyWtgxM1OEHc TKFSdphhfUbbkSZDi1Yw66/SuMTa1NumbpHz9zAMwEquRyY00SFbpeEznc17GKoe 9sPgwwZj+BcbdUKZHA9qTlv4pWNPE+IqWtt7aD8KqqQYs3V+zYmdXjzDGvVXE18m SoG13W81uKOWYhn+ZOQetfFpOdIETA5j6tY+hg1cpofqpZ/m+SoqCuVxqRFQsR6H QqFlveWv/FIpfoQJvzpiGPIEUswyG8kAn4fxVU5oqweo20WWplz2foiTxCd6pldm 13DsPXTfqFiYXKfaxBjn7VhZ+3HIR8BZzLMj7E53/+B0fqC8KGGTWgsNDWmKe2sX toncwDU4Og8Qw848+fYZJbs3R3PrmJy8q40UWZHlKkcP1Qj0CEk6kB9K8F02zD7r EVc0Nlt1wsw=1E7v -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . A significant security patch for Red Hat OpenStack Platform 16.1 has been released to mitigate potential risks associated with session cookie exposure.. Red Hat OpenStack, python-flask Update, securityimpact, advisory 2023. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Jun 06, 2023 Important Red Hat
87

Debian: DSA-5381-1 Severe: Tomcat9 HTTP Attack Risks and Fixes

Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2022-42252 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5381-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Markus Koschany April 05, 2023 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : tomcat9 CVE ID : CVE-2022-42252 CVE-2022-45143 CVE-2023-28708 Debian Bug : 1033475 Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2022-42252 Apache Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false. Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header. CVE-2022-45143 The JsonErrorReportValve in Apache Tomcat did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output. CVE-2023-28708 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. For the stable distribution (bullseye), these problems have been fixed in version 9.0.43-2~deb11u6. We recommend that you upgrade your tomcat9 packages. For the detailed security status of tomcat9 please refer to its security tracker pageat: https://security-tracker.debian.org/tracker/source-package/tomcat9 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Critical vulnerabilities identified in Tomcat's JSP processor necessitate immediate updates to mitigate risks. Update without delay.. Tomcat Security Update, HTTP Request Smuggling, Debian Security, Session Cookie Issue. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Apr 05, 2023 Important Debian
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Your message here