Skip to content
OpenAdvisories
High RHSA-2023:3446 1 CVE

Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (python-flask) security update

Published Sep 13, 2024 · Updated Jul 3, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · OpenStack 16 openstack:16.1::el8 python-flask 1:1.0.2-8.el8ost
Red Hat · OpenStack 16 openstack:16.1::el8 python3-flask 1:1.0.2-8.el8ost

Vulnerabilities 1

  • High 7.5
    CVE-2023-30861 Public exploit

    Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

    Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` he…

    pallets flask python-flask flask Debian Ubuntu Azure Linux PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2196643
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3446.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-30861
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-30861
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-30861
  • article
    https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b
  • article
    https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq