CVE-2018-1000656 Flask is vulnerable to Denial of Service via incorrect encoding of JSON data
An attacker can cause a denial of service by sending JSON data with incorrect encoding, leading to excessive memory usage in the Flask web framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000656?
CVE-2018-1000656 is a high-severity denial of service vulnerability in n/a, published on 20 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
Weakness: CWE-20
Which versions are affected by CVE-2018-1000656?
3 open source packages ship an affected version, including flask and Flask. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
flask PyPI | All versions | 0.12.3 |
flask PyPI | All versions | 0.12.3 |
Flask PyPI | All versions | 0.12.3 |
Linux distribution packages (4)
python-flask Red Hat:rhel_extras_other:7 | All versions | 1:0.10.1-5.el7_7 |
python-Flask SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 0.12.4-3.3.26 |
python-Flask SUSE:Linux Enterprise Module for Package Hub 15 | All versions | 0.12.4-3.3.26 |
python-Flask openSUSE:Leap 15.0 | All versions | 0.12.4-lp150.2.3.1 |
Products include Netapp Active Iq, Netapp Hyper Converged Infrastructure, Netapp Ontap Select Deploy Utility, Palletsprojects Flask.
How do I fix CVE-2018-1000656?
Upgrade flask to 0.12.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-1000656 being exploited?
There is no known exploitation of CVE-2018-1000656 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2018-1000656, DLA-1892-1, GHSA-562c-5r94-xh97, PYSEC-2018-66, RHSA-2020:0870, SUSE-SU-2019:0657-1 and 3 more.