[manjaro-security] [ASA-202105-2] python-flask-security-too: cross-site request forgery
Jonas Witschel via arch-security
arch-security at lists.archlinux.org
Thu May 20 19:59:17 CEST 2021
Arch Linux Security Advisory ASA-202105-2
Date : 2021-05-19
CVE-ID : CVE-2021-21241
Package : python-flask-security-too
Type : cross-site request forgery
Remote : Yes
Link : https://security.archlinux.org/AVG-1434
The package python-flask-security-too before version 4.0.1-1 is
vulnerable to cross-site request forgery.
Upgrade to 4.0.1-1.
# pacman -Syu "python-flask-security-too>=4.0.1-1"
The problem has been fixed upstream in version 4.0.1.
If you aren't using authentication tokens, you can set
SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token
In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the
/login and /change endpoints can return the authenticated user's
authentication token in response to a GET request. Since GET requests
aren't protected with a CSRF token, this could lead to a malicious 3rd
party site acquiring the authentication token. Version 3.4.5 and
version 4.0.0 are patched. As a workaround, if you aren't using
authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0"
(seconds) which should make the token unusable.
A remote attacker could obtain a user's authentication token from a
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the manjaro-security