Bug 1899267 (CVE-2020-28724)

Summary: CVE-2020-28724 python-werkzeug: open redirect via double slash in the URL
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, apevec, aurelien, bbuckingham, bcl, bcourt, bdettelb, bkearney, bmontgom, btotty, danielmyoung, dbecker, dblechte, dfediuck, eedri, eparis, hhorak, hhudgeon, hvyas, ian, igor.raits, jburrell, jjoyce, jokerman, jorton, jschluet, karlthered, kmullins, lhh, lpeer, lzap, manisandro, mburns, mgoldboi, michal.skrivanek, mmccune, nmoumoul, nstielau, python-maint, python-sig, rchan, relrod, rhos-maint, rjerrido, sbonazzo, sclewis, sherold, slinaber, sokeeffe, sponnaga, tomckay, yturgema
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: python-werkzeug 0.11.6 Doc Type: If docs needed, set a value
Doc Text:
An open redirect flaw was found in the WSGI library python-werkzeug. When URL_PATH starts with a double slash, followed by an arbitrary URL without a scheme, python-werkzeug could redirect applications to that arbitrary URL. This flaw allows an attacker to use this technique to redirect victims to phishing websites controlled by an attacker or to use this flaw to chain vulnerabilities.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-27 17:33:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1899268, 1899508    
Bug Blocks: 1899270    

Description Guilherme de Almeida Suckevicz 2020-11-18 19:17:07 UTC 
Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.

References:
https://github.com/pallets/werkzeug/issues/822
https://github.com/pallets/flask/issues/1639

Upstream patch:
https://github.com/pallets/werkzeug/pull/890
Comment 1 Guilherme de Almeida Suckevicz 2020-11-18 19:17:31 UTC 
Created python-werkzeug tracking bugs for this issue:

Affects: epel-6 [bug 1899268]
Comment 6 Product Security DevOps Team 2020-11-27 17:33:52 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-28724