CVE-2018-1000656
Fixed in a distro release EPSS 4%
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
Products: palletsprojects flask, netapp active_iq, netapp hyper_converged_infrastructure, netapp ontap_select_deploy_utility
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | flask | 0.12.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | flask | 1.0.2-1 |
| Debian 13 | flask | 1.0.2-1 |
| Debian 14 | flask | 1.0.2-1 |
| Debian 8 | flask | 0.10.1-2+deb8u1 |
| Red Hat rhel extras other 7 | python-flask | 1:0.10.1-5.el7_7 |
| SUSE Linux Enterprise Module for Basesystem 15 | python-Flask | 0.12.4-3.3.26 |
| SUSE Linux Enterprise Module for Package Hub 15 | python-Flask | 0.12.4-3.3.26 |
| Ubuntu 16.04 LTS | flask | 0.10.1-2ubuntu0.1 |
| Ubuntu 18.04 LTS | flask | 0.12.2-3ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | flask | 0.10.1-2ubuntu0.1~esm1 |
| openSUSE Leap 15.0 | python-Flask | 0.12.4-lp150.2.3.1 |