Security vulnerabilities due to old dependancies
Euphorbium opened this issue · 1 comments
Euphorbium commented
flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
The Requests package before 2.19.1 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
The versions of these libraries should be updated, especially since flask 1.0 has been released for a while now.
nk9 commented
This can now be closed.