~ / search / GHSA-562c-5r94-xh97

GHSA-562c-5r94-xh97

Flask is vulnerable to Denial of Service via incorrect encoding of JSON data

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000656

Packages

EcosystemPackageAffectedFixed in
PyPI Flask < 0.12.3 0.12.3

Details

As written in the advisory (Markdown source, shown as plain text).

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.

References

External links from the advisory. They lead to third-party sites.