Bug 34424 - python-flask-cors new security issues CVE-2024-1681, CVE-2024-6221, CVE-2024-6839, CVE-2024-6844, CVE-2024-6866
Summary: python-flask-cors new security issues CVE-2024-1681, CVE-2024-6221, CVE-2024-...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-07-04 09:31 CEST by Nicolas Salguero
Modified: 2025-11-13 19:04 CET (History)
4 users (show)

See Also:
Source RPM: python-flask-cors-3.0.10-1.mga9.src.rpm
CVE: CVE-2024-1681, CVE-2024-6221, CVE-2024-6839, CVE-2024-6844, CVE-2024-6866
Status comment:


Attachments

Description Nicolas Salguero 2025-07-04 09:31:58 CEST
Ubuntu has issued an advisory on July 3:
https://ubuntu.com/security/notices/USN-7612-1
Nicolas Salguero 2025-07-04 09:32:41 CEST

CVE: (none) => CVE-2024-1681, CVE-2024-6221, CVE-2024-6839, CVE-2024-6844, CVE-2024-6866
Status comment: (none) => Patches available from Ubuntu
Whiteboard: (none) => MGA9TOO
Source RPM: (none) => python-flask-cors-5.0.0-4.mga10.src.rpm, python-flask-cors-3.0.10-1.mga9.src.rpm

Comment 1 Marja Van Waes 2025-07-05 20:08:22 CEST
Assignig to the registered maintainer, CC'ing the Python Stack maintainers.

Assignee: bugsquad => cooker
CC: (none) => marja11, python

Comment 2 Nicolas Salguero 2025-11-10 11:02:18 CET
Suggested advisory:
========================

The updated package fixes security vulnerabilities:

Log Injection Vulnerability in corydolphin/flask-cors. (CVE-2024-1681)

Improper Access Control in corydolphin/flask-cors. (CVE-2024-6221)

Improper Regex Path Matching in corydolphin/flask-cors. (CVE-2024-6839)

Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors. (CVE-2024-6844)

Case-Insensitive Path Matching in corydolphin/flask-cors. (CVE-2024-6866)

References:
https://ubuntu.com/security/notices/USN-7612-1
========================

Updated package in core/updates_testing:
========================
python3-flask-cors-3.0.10-1.1.mga9

from SRPM:
python-flask-cors-3.0.10-1.1.mga9.src.rpm

Version: Cauldron => 9
Status comment: Patches available from Ubuntu => (none)
Status: NEW => ASSIGNED
Assignee: cooker => qa-bugs
Source RPM: python-flask-cors-5.0.0-4.mga10.src.rpm, python-flask-cors-3.0.10-1.mga9.src.rpm => python-flask-cors-3.0.10-1.mga9.src.rpm
Whiteboard: MGA9TOO => (none)

katnatek 2025-11-11 22:52:03 CET

Keywords: (none) => advisory

Comment 3 katnatek 2025-11-12 19:52:40 CET
LC_ALL=C urpmi python3-flask-cors
To satisfy dependencies, the following packages are going to be installed:
  Package                        Version      Release       Arch    
(medium "QA Testing (64-bit)")
  python3-flask-cors             3.0.10       1.1.mga9      noarch  
(medium "Core Release")
  python3-blinker                1.6.2        1.mga9        noarch  
  python3-click                  8.1.3        1.mga9        noarch  
  python3-flask                  2.3.2        1.mga9        noarch  
  python3-itsdangerous           2.1.2        1.mga9        noarch  
(medium "Core Updates")
  python3-werkzeug               3.0.6        1.mga9        noarch  
3.2MB of additional disk space will be used.
763KB of packages will be retrieved.
Proceed with the installation of the 6 packages? (Y/n) y


    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/python3-flask-2.3.2-1.mga9.noarch.rpm
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/python3-click-8.1.3-1.mga9.noarch.rpm            
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/python3-itsdangerous-2.1.2-1.mga9.noarch.rpm     
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/python3-blinker-1.6.2-1.mga9.noarch.rpm          
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/python3-werkzeug-3.0.6-1.mga9.noarch.rpm         
installing /var/cache/urpmi/rpms/python3-flask-2.3.2-1.mga9.noarch.rpm                                                                
/var/cache/urpmi/rpms/python3-click-8.1.3-1.mga9.noarch.rpm
/var/cache/urpmi/rpms/python3-werkzeug-3.0.6-1.mga9.noarch.rpm
/var/cache/urpmi/rpms/python3-itsdangerous-2.1.2-1.mga9.noarch.rpm
//home/katnatek/qa-testing/x86_64/python3-flask-cors-3.0.10-1.1.mga9.noarch.rpm
/var/cache/urpmi/rpms/python3-blinker-1.6.2-1.mga9.noarch.rpm
Preparing...                     ####################################################################################################
      1/6: python3-blinker       ####################################################################################################
      2/6: python3-itsdangerous  ####################################################################################################
      3/6: python3-werkzeug      ####################################################################################################
      4/6: python3-click         ####################################################################################################
      5/6: python3-flask         ####################################################################################################
      6/6: python3-flask-cors    ####################################################################################################


urpmq --whatrequires python3-flask-cors
openlp
openlp
python3-flask-cors

urpmq -pi openlp
Name        : openlp
Version     : 3.0.2
Release     : 1.mga9
Group       : Publishing
Size        : 19411579                     Architecture: noarch
Source RPM  : openlp-3.0.2-1.mga9.src.rpm
URL         : https://openlp.org/
Summary     : Open source Church presentation and lyrics projection application
Description :
openlp is a church presentation software, for lyrics projection software,
used to display slides of Songs, Bible verses, videos, images, and
presentations via LibreOffice using a computer and projector.

I ignore how oenlp works, so I let in clean install

Whiteboard: (none) => MGA9-64-OK

Comment 4 Thomas Andrews 2025-11-13 17:22:14 CET
I don't have a projector for my computer, either. Clean install will have to be close enough.

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 5 Mageia Robot 2025-11-13 19:04:53 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0286.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.