CVE-2018-1000656 (High) detected in Flask-0.12.2-py2.py3-none-any.whl

[mend-bolt-for-github]

CVE-2018-1000656 - High Severity Vulnerability

Vulnerable Library - Flask-0.12.2-py2.py3-none-any.whl

A microframework based on Werkzeug, Jinja2 and good intentions

Library home page: https://pypi.python.org/packages/77/32/e3597cb19ffffe724ad4bf0beca4153419918e7fa4ba6a34b04ee4da3371/Flask-0.12.2-py2.py3-none-any.whl

Dependency Hierarchy:

• ❌ Flask-0.12.2-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.

Publish Date: 2018-08-20

URL: CVE-2018-1000656

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1000656

Release Date: 2018-08-20

Fix Resolution: 0.12.3

---

Step up your Open Source Security Game with WhiteSource here