fix: Bumps Flask Caching to fix RCE vulnerability

[michael-s-molina]

SUMMARY

This PR bumps Flask Caching from 1.10.1 to 1.11.1 to fix CVE-2021-33026. It also removes an explicit dependency with cachelib given that its assets are provided via flask_caching.backends.

Fixes #25077

Here's the changelog between versions:

TESTING INSTRUCTIONS

CI should be sufficient.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[villebro]

LGTM, thanks for all the work on debugging that flaky test, really great work! 👏 Also, please add a note in the description about removing cachelib as an explicit dependency, as it may not be obvious why that's happening.

[villebro]

I'm tempted to bump this one to a more recent one, but let's do that when we bump to Flask-Caching>=2

[michael-s-molina]

Yes, it's safer to do that when bumping Flask-Caching 👍🏼

[michael-s-molina]

Also, please add a note in the description about removing cachelib as an explicit dependency, as it may not be obvious why that's happening.

@villebro I updated the PR description.

[SCH227]

@michael-s-molina Flask-caching 1.11.1 does not fixes CVE-2021-33026.
Lastest version of flask-caching still relies on pickle by default for deserialization from cache storage. For example:
Memcache
Rediscache
Am I missing something?

[michael-s-molina]

@SCH227 It looks like the CVE is still in DISPUTED state pending additional verification. Check pallets-eco/flask-caching#345 for more context.