CVE-2020-25032

An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.

References

Affected packages

Debian:11 / python-flask-cors

Package

Name: python-flask-cors
Purl: pkg:deb/debian/python-flask-cors?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.9-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / python-flask-cors

Package

Name: python-flask-cors
Purl: pkg:deb/debian/python-flask-cors?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.9-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / python-flask-cors

Package

Name: python-flask-cors
Purl: pkg:deb/debian/python-flask-cors?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.9-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/corydolphin/flask-cors

Affected ranges

Type: GIT
Repo: https://github.com/corydolphin/flask-cors
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

91babb941e07a1f45636bdcb75675f13ce1503a2

Affected versions

1.*

1.10.0

1.10.1

1.10.2

1.10.3

1.8.1

1.9.0

2.*

2.0.0

2.0.0rc1

2.0.1

2.1.0

2.1.1

2.1.2

2.1.3

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

v1.*

v1.1

v1.1.1

v1.1.2

v1.1.3

v1.2.0

v1.2.1

v1.3.0

v1.3.1

v1.4.0

v1.6.0

v1.6.1

v1.7.0

v1.7.2

v1.7.3

v1.7.4

v1.8.0