Debian-LTS has issued an advisory on February 27: https://www.debian.org/lts/security/2023/dla-3346 The issues are fixed upstream in 2.2.3: https://github.com/pallets/werkzeug/security/advisories/GHSA-px8h-6qxv-m22q https://github.com/pallets/werkzeug/security/advisories/GHSA-xg9f-g7g7-2323 Mageia 8 is also affected.
Status comment: (none) => Fixed upstream in 2.2.3Whiteboard: (none) => MGA8TOO
This is nominally with NicolasL, who commited v2.2.2; CC'ing him, assigning to Pÿthon maintainers.
Assignee: bugsquad => pythonCC: (none) => mageia
Fedora has issued an advisory for this on March 11: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/M2GTOE47WJ7BTBX2ENLG3VMBHVJQPH2D/ It looks like python-flask should be updated with this: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OPHK7NCUAEEG647ETCSFYCZP47H4D7XV/
Fedora advisory that actually has CVE references: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VTNTWI7NG5ZWHOUWADRZKPL3DMYZNC3Z/
Ubuntu has issued an advisory for this on March 13: https://ubuntu.com/security/notices/USN-5948-1
Summary: python-werzkeug new security issues CVE-2023-23934 and CVE-2023-25577 => python-werkzeug new security issues CVE-2023-23934 and CVE-2023-25577
This is done since 2023-03-14 for cauldron by David G
Version: Cauldron => 8Whiteboard: MGA8TOO => (none)CC: (none) => yves.brungard_mageia
More specifically, python-werkzeug-2.2.3-1.mga9 was uploaded.
Source RPM: python-werkzeug-2.2.2-1.mga9.src.rpm => python-werkzeug-1.0.1-1.mga8.src.rpm
Mageia 8 EOL
Status: NEW => RESOLVEDResolution: (none) => OLDCC: (none) => nicolas.salguero