SUSE has issued an advisory on November 1: https://lists.suse.com/pipermail/sle-security-updates/2022-November/012786.html Note that this software is unmaintained upstream. Apparently it has been replaced by flask-security-too (which is also vulnerable to this issue, where it is known as CVE-2021-32618). So this package should be dropped or replaced in Cauldron as well. Mageia 8 is also affected.
Priority: Normal => release_blockerTarget Milestone: --- => Mageia 9Whiteboard: (none) => MGA8TOO
Equivalent openSUSE advisory: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RQJQLV6QJLKHFTPTOHMNIPI43YRAGCIO/
Well, immediately, this needs addressing. Assigning globally as various packagers have dealt with this package. CC'ing Joseph who is registered maintainer, in case you want to do this. Have noted to drop in the TRACKER bug 30163.
Assignee: bugsquad => pkg-bugsCC: (none) => joequant
Correcting assignnment to Python maintainers.
Assignee: pkg-bugs => python
openSUSE advisory for python-flask-security-too from November 3: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PF7CUVFV2HIA3SO656CPSXCDYD5VGKAH/
Removed from cauldron. https://svnweb.mageia.org/packages/obsolete/python-flask-security/
Version: Cauldron => 8CC: (none) => yves.brungard_mageiaWhiteboard: MGA8TOO => (none)
Target Milestone: Mageia 9 => ---Priority: release_blocker => High
Applying a patch from opensuse. https://build.opensuse.org/package/view_file/SUSE:SLE-15-SP1:Update/python-Flask-Security/fix-open-redirect.patch?expand=1 python3-flask-security-3.0.0-1.1.mga8.noarch.rpm Source: python-flask-security-3.0.0-1.1.mga8.src.rpm
Assignee: python => qa-bugs
(In reply to papoteur from comment #5) > Removed from cauldron. > https://svnweb.mageia.org/packages/obsolete/python-flask-security/ No, it's still in Cauldron: http://mirrors.kernel.org/mageia/distrib/cauldron/SRPMS/core/release/python-flask-security-3.0.0-5.mga9.src.rpm
Priority: High => release_blockerAssignee: qa-bugs => pythonVersion: 8 => CauldronWhiteboard: (none) => MGA8TOOCC: (none) => qa-bugs
This package has successfully been obsoleted in Cauldron. Closing as fixed.
Status: NEW => RESOLVEDResolution: (none) => FIXEDCC: (none) => smelror
The Mageia 8 fix is not yet validated.
Priority: release_blocker => NormalResolution: FIXED => (none)Version: Cauldron => 8Status: RESOLVED => REOPENEDAssignee: python => qa-bugsWhiteboard: MGA8TOO => (none)
Mageia 8 update in Comment 6.
Source RPM: python-flask-security-3.0.0-5.mga9.src.rpm => python-flask-security-3.0.0-1.mga8.src.rpm
Mageia8, x86_64 Updated the package via qarepo -> MageiaUpdate. Tried the tutorial at: https://flask-security.readthedocs.io/en/3.0.0/quickstart.html but did not get very far with it. $ python alchemy.py > session /usr/lib/python3.8/site-packages/flask_sqlalchemy/__init__.py:793: FSADeprecationWarning: SQLALCHEMY_TRACK_MODIFICATIONS adds significant overhead and will be disabled by default in the future. Set it to True or False to suppress this warning. warnings.warn(FSADeprecationWarning( * Running on http://127.0.0.1:5000/ (Press CTRL+C to quit) * Restarting with stat /usr/lib/python3.8/site-packages/flask_sqlalchemy/__init__.py:793: FSADeprecationWarning: SQLALCHEMY_TRACK_MODIFICATIONS adds significant overhead and will be disabled by default in the future. Set it to True or False to suppress this warning. warnings.warn(FSADeprecationWarning( * Debugger is active! * Debugger PIN: 129-755-916 This runs and shows a login at localhost:5000/ in a browser, which asks for email address and login password. No idea what it is looking for. Provided email address then tried gmail password which failed then my local login password. Both resulted in user not identified. I would guess that this is working as intended. Giving this a tentative OK.
Whiteboard: (none) => MGA8-64-OKCC: (none) => tarazed25
Out of my element, but a wild guess would be that the gmail password failed because Gmail no longer allows "insecure third party apps" to log onto the server with a simple password. The email part of the tutorial sounded to me like it was for some kind of internal email, not something like gmail, anyway Of course, I could easily be completely wrong. As I said, it's out of my element. Validating.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => advisoryCC: (none) => davidwhodgins
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2023-0105.html
Resolution: (none) => FIXEDStatus: REOPENED => RESOLVED