Bug 1623131 (CVE-2018-1000656)

Summary:	CVE-2018-1000656 python-flask: Denial of Service via crafted JSON file
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abhgupta, amctagga, aoconnor, apmukher, bbuckingham, bcl, bcourt, bdoran, bkearney, bniver, bshahu, danielmyoung, dbaker, fdc, flucifre, gmeno, hushan.jia, ian, itamar, jkeck, jlyle, jokerman, karlthered, kkinge, mbenjamin, mhackett, mmccune, nitthoma, ohadlevy, puiterwijk, rajukuma, rchan, relrod, rjerrido, saydas, security-response-team, sisharma, sostapov, sthangav, tflink, trankin, vbellur, vereddy, yjog
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-flask 0.12.3	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-17 22:31:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1623179, 1623180, 1623770, 1623771, 1623772, 1633596, 1636188, 1642087, 1810065, 1810068, 2254402
Bug Blocks:	1623143

Description Laura Pardo 2018-08-28 14:23:37 UTC

A flaw was found in The Pallets Project flask version Before 0.12.3. An Improper Input Validation vulnerability in flask that can result in a large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding.


References:
https://github.com/pallets/flask/pull/2691

Comment 1 Laura Pardo 2018-08-28 16:23:00 UTC

Created python-flask tracking bugs for this issue:

Affects: fedora-all [bug 1623179]

Comment 20 Richard Maciel Costa 2019-03-29 13:07:41 UTC

Statement:

This issue affects the versions of python-flask as shipped with Red Hat Enterprise Linux 7.

Although Red Hat Satellite 6 contains the vulnerable component, the former is not affected due to python-flask only receiving JSON data created by other Red Hat Satellite 6 components, not user-controlled JSON data, which makes the attack unfeasible.

Comment 26 errata-xmlrpc 2020-03-17 17:11:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extras

Via RHSA-2020:0870 https://access.redhat.com/errata/RHSA-2020:0870

Comment 27 Product Security DevOps Team 2020-03-17 22:31:43 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-1000656