Bug 31069

Equivalent openSUSE advisory:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RQJQLV6QJLKHFTPTOHMNIPI43YRAGCIO/

Well, immediately, this needs addressing.
Assigning globally as various packagers have dealt with this package.
CC'ing Joseph who is registered maintainer, in case you want to do this.

Have noted to drop in the TRACKER bug 30163.

Assignee: bugsquad => pkg-bugs
CC: (none) => joequant

Correcting assignnment to Python maintainers.

Assignee: pkg-bugs => python

openSUSE advisory for python-flask-security-too from November 3:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PF7CUVFV2HIA3SO656CPSXCDYD5VGKAH/

Removed from cauldron.
https://svnweb.mageia.org/packages/obsolete/python-flask-security/

Version: Cauldron => 8
CC: (none) => yves.brungard_mageia
Whiteboard: MGA8TOO => (none)

Applying a patch from opensuse.
https://build.opensuse.org/package/view_file/SUSE:SLE-15-SP1:Update/python-Flask-Security/fix-open-redirect.patch?expand=1

python3-flask-security-3.0.0-1.1.mga8.noarch.rpm

Source:
python-flask-security-3.0.0-1.1.mga8.src.rpm

Assignee: python => qa-bugs

(In reply to papoteur from comment #5)
> Removed from cauldron.
> https://svnweb.mageia.org/packages/obsolete/python-flask-security/

No, it's still in Cauldron:
http://mirrors.kernel.org/mageia/distrib/cauldron/SRPMS/core/release/python-flask-security-3.0.0-5.mga9.src.rpm

Priority: High => release_blocker
Assignee: qa-bugs => python
Version: 8 => Cauldron
Whiteboard: (none) => MGA8TOO
CC: (none) => qa-bugs

This package has successfully been obsoleted in Cauldron.

Closing as fixed.

Status: NEW => RESOLVED
Resolution: (none) => FIXED
CC: (none) => smelror

The Mageia 8 fix is not yet validated.

Priority: release_blocker => Normal
Resolution: FIXED => (none)
Version: Cauldron => 8
Status: RESOLVED => REOPENED
Assignee: python => qa-bugs
Whiteboard: MGA8TOO => (none)

Mageia 8 update in Comment 6.

Source RPM: python-flask-security-3.0.0-5.mga9.src.rpm => python-flask-security-3.0.0-1.mga8.src.rpm

Mageia8, x86_64

Updated the package via qarepo -> MageiaUpdate.
Tried the tutorial at:
https://flask-security.readthedocs.io/en/3.0.0/quickstart.html
but did not get very far with it.

$ python alchemy.py > session
/usr/lib/python3.8/site-packages/flask_sqlalchemy/__init__.py:793: FSADeprecationWarning: SQLALCHEMY_TRACK_MODIFICATIONS adds significant overhead and will be disabled by default in the future.  Set it to True or False to suppress this warning.
  warnings.warn(FSADeprecationWarning(
 * Running on http://127.0.0.1:5000/ (Press CTRL+C to quit)
 * Restarting with stat
/usr/lib/python3.8/site-packages/flask_sqlalchemy/__init__.py:793: FSADeprecationWarning: SQLALCHEMY_TRACK_MODIFICATIONS adds significant overhead and will be disabled by default in the future.  Set it to True or False to suppress this warning.
  warnings.warn(FSADeprecationWarning(
 * Debugger is active!
 * Debugger PIN: 129-755-916

This runs and  shows a login at localhost:5000/ in a browser, which asks for email address and login password.  No idea what it is looking for.   Provided email address then tried gmail password which failed then my local login password.  Both resulted in user not identified.  I would guess that this is working as intended.

Giving this a tentative OK.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => tarazed25

Out of my element, but a wild guess would be that the gmail password failed because Gmail no longer allows "insecure third party apps" to log onto the server with a simple password. The email part of the tutorial sounded to me like it was for some kind of internal email, not something like gmail, anyway

Of course, I could easily be completely wrong. As I said, it's out of my element.

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0105.html

Resolution: (none) => FIXED
Status: REOPENED => RESOLVED