CVEvulnerability
CVE-2018-1000656
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-08-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-20
Description
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
Affected configurations
• palletsprojects flask (< 0.12.3)
• netapp active iq
• netapp hyper converged infrastructure
• netapp ontap select deploy utility
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://github.com/pallets/flask/pull/2691 Issue Tracking, Patch, Third Party Advisory
- https://github.com/pallets/flask/releases/tag/0.12.3 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00025.html lists.debian.org
- https://security.netapp.com/advisory/ntap-20190221-0001/ Patch, Third Party Advisory
- https://usn.ubuntu.com/4378-1/ usn.ubuntu.com
- https://github.com/pallets/flask/pull/2691 Issue Tracking, Patch, Third Party Advisory
- https://github.com/pallets/flask/releases/tag/0.12.3 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00025.html lists.debian.org
- https://security.netapp.com/advisory/ntap-20190221-0001/ Patch, Third Party Advisory
- https://usn.ubuntu.com/4378-1/ usn.ubuntu.com