High severity · published Aug 20, 2018
CVE-2018-1000656
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly…
7.5
CVSS
3.9%
EPSS
No
On KEV
Description
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ · Netapp
All versions, or not specified · source: NVD
FL
Flask · Palletsprojects
before 0.12.3 · source: NVD
HC
Hyper Converged Infrastructure · Netapp
All versions, or not specified · source: NVD
OS
Ontap Select Deploy Utility · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1000656
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1000656
Issue Tracking
https://github.com/pallets/flask/pull/2691
Third Party Advisory
https://github.com/pallets/flask/releases/tag/0.12.3
lists.debian.org
https://lists.debian.org/debian-lts-announce/2019/08/msg00025.html
Patch
https://security.netapp.com/advisory/ntap-20190221-0001/
usn.ubuntu.com
https://usn.ubuntu.com/4378-1/
More from Active IQ
8.1
CVE-2019-3462
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to…
7.5
CVE-2022-24785
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates
7.0
CVE-2019-11486
The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions