CVE-2023-30861
First published: Mon May 01 2023(Updated: )
When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent). 2. The application does not access or modify the session at any point during a request. 4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Palletsprojects Flask | <2.2.5 | |
| Palletsprojects Flask | >=2.3.0<2.3.2 | |
| debian/flask | <=1.0.2-3 | 1.0.2-3+deb10u1 1.1.2-2+deb11u1 2.2.2-3 2.2.5-1 |
| IBM Watson Knowledge Catalog on-prem | <=4.x | |
| pip/flask | <2.2.5 | 2.2.5 |
| pip/flask | >=2.3.0<2.3.2 | 2.3.2 |
| redhat/flask | <2.2.5 | 2.2.5 |
| redhat/flask | <2.3.2 | 2.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
- https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b
- https://github.com/pallets/flask/releases/tag/2.3.2
- https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965
- https://nvd.nist.gov/vuln/detail/CVE-2023-30861
- https://github.com/pallets/flask/releases/tag/2.2.5
- https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2023-62.yaml
- https://www.debian.org/security/2023/dsa-5442
- https://security.netapp.com/advisory/ntap-20230818-0006/
- https://lists.debian.org/debian-lts-announce/2023/08/msg00024.html
- https://github.com/advisories/GHSA-m2qf-hxjv-5gpq (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/254247
- https://www.ibm.com/support/pages/node/7009747 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196644
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196645
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196676
- https://access.redhat.com/errata/RHSA-2023:3440
- https://access.redhat.com/errata/RHSA-2023:3444
- https://access.redhat.com/errata/RHSA-2023:3446
- https://access.redhat.com/errata/RHSA-2023:3525
- https://access.redhat.com/security/cve/cve-2023-30861
- https://access.redhat.com/errata/RHSA-2023:3536
- https://access.redhat.com/errata/RHSA-2023:3545
- https://access.redhat.com/errata/RHSA-2023:7341
- https://bugzilla.redhat.com/show_bug.cgi?id=2196643
- https://github.com/pallets/flask/commit/8646edca6f47e2cd57464081b3911218d4734f8d
- https://github.com/pallets/flask/commit/8705dd39c4fa563ea0fe0bf84c85da8fcc98b88d
- https://security-tracker.debian.org/tracker/CVE-2023-30861
Frequently Asked Questions
What is CVE-2023-30861?
CVE-2023-30861 is a vulnerability in Pallets Flask that could allow a remote attacker to obtain sensitive information.
What is the severity of CVE-2023-30861?
The severity of CVE-2023-30861 is high with a CVSS score of 7.5.
How does CVE-2023-30861 affect Pallets Flask?
CVE-2023-30861 affects Pallets Flask versions 2.2.5 up to, but excluding, 2.3.2.
How can I fix CVE-2023-30861?
To fix CVE-2023-30861, update Pallets Flask to version 2.3.2 or apply a suitable remedy provided by your distribution.
Where can I find more information about CVE-2023-30861?
You can find more information about CVE-2023-30861 in the following references: - [GitHub Commit](https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b) - [Flask 2.3.2 Release](https://github.com/pallets/flask/releases/tag/2.3.2) - [Flask 2.2.5 Release](https://github.com/pallets/flask/releases/tag/2.2.5)
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/github-advisory
- alias/GHSA-m2qf-hxjv-5gpq
- alias/CVE-2023-30861
- collector/github-advisory-latest
- collector/ibm-support
- collector/nvd-api
- collector/nvd-cve
- collector/nvd-index
- collector/nvd-latest
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/security-tracker-debian
- package-manager/pip
- vendor/ibm
- canonical/ibm watson knowledge catalog on-prem
- version/ibm watson knowledge catalog on-prem/4.x
- vendor/palletsprojects
- canonical/palletsprojects flask
- version/palletsprojects flask/2.3.0
- package-manager/redhat
- package-manager/debian