PublicDateAtUSN: 2018-08-20 19:31:00 UTC
Candidate: CVE-2018-1000656
PublicDate: 2018-08-20 19:31:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000656
 https://github.com/pallets/flask/releases/tag/0.12.3
 https://ubuntu.com/security/notices/USN-4378-1
Description:
 The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper
 Input Validation vulnerability in flask that can result in Large amount of
 memory usage possibly leading to denial of service. This attack appear to
 be exploitable via Attacker provides JSON data in incorrect encoding. This
 vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap
 CVE-2019-1010083.
Ubuntu-Description:
Notes:
Bugs:
Priority: low
Discovered-by:
Assigned-to: leosilva
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]


Patches_flask:
 upstream: https://github.com/pallets/flask/commit/0e1e9a04aaf29ab78f721cfc79ac2a691f6e3929
 upstream: https://github.com/pallets/flask/pull/2691
upstream_flask: released (1.0.2-1)
precise/esm_flask: DNE
trusty_flask: ignored (reached end-of-life)
trusty/esm_flask: released (0.10.1-2ubuntu0.1~esm1)
xenial_flask: released (0.10.1-2ubuntu0.1)
esm-infra/xenial_flask: released (0.10.1-2ubuntu0.1)
bionic_flask: released (0.12.2-3ubuntu0.1)
cosmic_flask: not-affected (1.0.2-1)
disco_flask: not-affected (1.0.2-1)
eoan_flask: not-affected (1.0.2-1)
focal_flask: not-affected (1.0.2-1)
devel_flask: not-affected (1.0.2-1)