GitHub Advisoryadvisory · PyPI
GHSA-5wv5-4vpf-pj6m Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage
HIGH
Official page ↗
- Aliases
- CVE-2019-1010083
- Ecosystem
- PyPI
- Packages
- Flask
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2019-07-19
Affected packages
• PyPI Flask: < 1.0 → fixed in 1.0
Description
The Pallets Project Flask before 1.0 is affected by unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. The fixed version is 1. NOTE this may overlap CVE-2018-1000656.
Related
Alias · CVE (1)
- CVE-2019-1010083 The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-1010083 advisory
- https://github.com/advisories/GHSA-5wv5-4vpf-pj6m advisory
- https://github.com/pallets/flask package
- https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2019-179.yaml web
- https://www.palletsprojects.com/blog/flask-1-0-released web