{
   affected: [
      {
         package: {
            ecosystem: "PyPI",
            name: "flask-security-too",
            purl: "pkg:pypi/flask-security-too",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "61d313150b5f620d0b800896c4f2199005e84b1f",
                  },
                  {
                     fixed: "6d50ee9169acf813257c37b75babe9c28e83542a",
                  },
               ],
               repo: "https://github.com/Flask-Middleware/flask-security",
               type: "GIT",
            },
            {
               events: [
                  {
                     introduced: "3.3.0",
                  },
                  {
                     fixed: "3.4.5",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
         versions: [
            "3.3.0",
            "3.3.1",
            "3.3.2",
            "3.3.3",
            "3.4.0",
            "3.4.1",
            "3.4.2",
            "3.4.3",
            "3.4.4",
         ],
      },
   ],
   aliases: [
      "CVE-2021-21241",
      "GHSA-hh7m-rx4f-4vpv",
   ],
   details: "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.",
   id: "PYSEC-2021-91",
   modified: "2021-06-09T05:01:03.786366Z",
   published: "2021-01-11T21:15:00Z",
   references: [
      {
         type: "WEB",
         url: "https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5",
      },
      {
         type: "PACKAGE",
         url: "https://pypi.org/project/Flask-Security-Too",
      },
      {
         type: "FIX",
         url: "https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f",
      },
      {
         type: "ADVISORY",
         url: "https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv",
      },
      {
         type: "WEB",
         url: "https://github.com/Flask-Middleware/flask-security/pull/422",
      },
      {
         type: "FIX",
         url: "https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "python310-Flask-Security-Too-5.3.2-3.1 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the python310-Flask-Security-Too-5.3.2-3.1 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2024-13561",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13561-1.json",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21241 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21241/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-23385 page",
            url: "https://www.suse.com/security/cve/CVE-2021-23385/",
         },
      ],
      title: "python310-Flask-Security-Too-5.3.2-3.1 on GA media",
      tracking: {
         current_release_date: "2024-06-15T00:00:00Z",
         generator: {
            date: "2024-06-15T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2024:13561-1",
         initial_release_date: "2024-06-15T00:00:00Z",
         revision_history: [
            {
               date: "2024-06-15T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python310-Flask-Security-Too-5.3.2-3.1.aarch64",
                        product: {
                           name: "python310-Flask-Security-Too-5.3.2-3.1.aarch64",
                           product_id: "python310-Flask-Security-Too-5.3.2-3.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python311-Flask-Security-Too-5.3.2-3.1.aarch64",
                        product: {
                           name: "python311-Flask-Security-Too-5.3.2-3.1.aarch64",
                           product_id: "python311-Flask-Security-Too-5.3.2-3.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python39-Flask-Security-Too-5.3.2-3.1.aarch64",
                        product: {
                           name: "python39-Flask-Security-Too-5.3.2-3.1.aarch64",
                           product_id: "python39-Flask-Security-Too-5.3.2-3.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
                        product: {
                           name: "python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
                           product_id: "python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
                        product: {
                           name: "python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
                           product_id: "python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
                        product: {
                           name: "python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
                           product_id: "python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python310-Flask-Security-Too-5.3.2-3.1.s390x",
                        product: {
                           name: "python310-Flask-Security-Too-5.3.2-3.1.s390x",
                           product_id: "python310-Flask-Security-Too-5.3.2-3.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python311-Flask-Security-Too-5.3.2-3.1.s390x",
                        product: {
                           name: "python311-Flask-Security-Too-5.3.2-3.1.s390x",
                           product_id: "python311-Flask-Security-Too-5.3.2-3.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python39-Flask-Security-Too-5.3.2-3.1.s390x",
                        product: {
                           name: "python39-Flask-Security-Too-5.3.2-3.1.s390x",
                           product_id: "python39-Flask-Security-Too-5.3.2-3.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python310-Flask-Security-Too-5.3.2-3.1.x86_64",
                        product: {
                           name: "python310-Flask-Security-Too-5.3.2-3.1.x86_64",
                           product_id: "python310-Flask-Security-Too-5.3.2-3.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python311-Flask-Security-Too-5.3.2-3.1.x86_64",
                        product: {
                           name: "python311-Flask-Security-Too-5.3.2-3.1.x86_64",
                           product_id: "python311-Flask-Security-Too-5.3.2-3.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python39-Flask-Security-Too-5.3.2-3.1.x86_64",
                        product: {
                           name: "python39-Flask-Security-Too-5.3.2-3.1.x86_64",
                           product_id: "python39-Flask-Security-Too-5.3.2-3.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "python310-Flask-Security-Too-5.3.2-3.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.aarch64",
            },
            product_reference: "python310-Flask-Security-Too-5.3.2-3.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python310-Flask-Security-Too-5.3.2-3.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
            },
            product_reference: "python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python310-Flask-Security-Too-5.3.2-3.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.s390x",
            },
            product_reference: "python310-Flask-Security-Too-5.3.2-3.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python310-Flask-Security-Too-5.3.2-3.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.x86_64",
            },
            product_reference: "python310-Flask-Security-Too-5.3.2-3.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python311-Flask-Security-Too-5.3.2-3.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.aarch64",
            },
            product_reference: "python311-Flask-Security-Too-5.3.2-3.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python311-Flask-Security-Too-5.3.2-3.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
            },
            product_reference: "python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python311-Flask-Security-Too-5.3.2-3.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.s390x",
            },
            product_reference: "python311-Flask-Security-Too-5.3.2-3.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python311-Flask-Security-Too-5.3.2-3.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.x86_64",
            },
            product_reference: "python311-Flask-Security-Too-5.3.2-3.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python39-Flask-Security-Too-5.3.2-3.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.aarch64",
            },
            product_reference: "python39-Flask-Security-Too-5.3.2-3.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python39-Flask-Security-Too-5.3.2-3.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
            },
            product_reference: "python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python39-Flask-Security-Too-5.3.2-3.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.s390x",
            },
            product_reference: "python39-Flask-Security-Too-5.3.2-3.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python39-Flask-Security-Too-5.3.2-3.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.x86_64",
            },
            product_reference: "python39-Flask-Security-Too-5.3.2-3.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2021-21241",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21241",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.aarch64",
               "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
               "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.s390x",
               "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.x86_64",
               "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.aarch64",
               "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
               "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.s390x",
               "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.x86_64",
               "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.aarch64",
               "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
               "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.s390x",
               "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21241",
               url: "https://www.suse.com/security/cve/CVE-2021-21241",
            },
            {
               category: "external",
               summary: "SUSE Bug 1181058 for CVE-2021-21241",
               url: "https://bugzilla.suse.com/1181058",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.x86_64",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.x86_64",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.x86_64",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.x86_64",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-21241",
      },
      {
         cve: "CVE-2021-23385",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-23385",
            },
         ],
         notes: [
            {
               category: "general",
               text: "This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.aarch64",
               "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
               "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.s390x",
               "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.x86_64",
               "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.aarch64",
               "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
               "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.s390x",
               "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.x86_64",
               "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.aarch64",
               "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
               "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.s390x",
               "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-23385",
               url: "https://www.suse.com/security/cve/CVE-2021-23385",
            },
            {
               category: "external",
               summary: "SUSE Bug 1202105 for CVE-2021-23385",
               url: "https://bugzilla.suse.com/1202105",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.x86_64",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.x86_64",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.2-3.1.x86_64",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.2-3.1.x86_64",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.aarch64",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.ppc64le",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.s390x",
                  "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.2-3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-23385",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "python310-Flask-Security-5.5.2-1.1 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the python310-Flask-Security-5.5.2-1.1 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2024-14555",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14555-1.json",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21241 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21241/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-23385 page",
            url: "https://www.suse.com/security/cve/CVE-2021-23385/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-49438 page",
            url: "https://www.suse.com/security/cve/CVE-2023-49438/",
         },
      ],
      title: "python310-Flask-Security-5.5.2-1.1 on GA media",
      tracking: {
         current_release_date: "2024-12-06T00:00:00Z",
         generator: {
            date: "2024-12-06T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2024:14555-1",
         initial_release_date: "2024-12-06T00:00:00Z",
         revision_history: [
            {
               date: "2024-12-06T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python310-Flask-Security-5.5.2-1.1.aarch64",
                        product: {
                           name: "python310-Flask-Security-5.5.2-1.1.aarch64",
                           product_id: "python310-Flask-Security-5.5.2-1.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python311-Flask-Security-5.5.2-1.1.aarch64",
                        product: {
                           name: "python311-Flask-Security-5.5.2-1.1.aarch64",
                           product_id: "python311-Flask-Security-5.5.2-1.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python312-Flask-Security-5.5.2-1.1.aarch64",
                        product: {
                           name: "python312-Flask-Security-5.5.2-1.1.aarch64",
                           product_id: "python312-Flask-Security-5.5.2-1.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python313-Flask-Security-5.5.2-1.1.aarch64",
                        product: {
                           name: "python313-Flask-Security-5.5.2-1.1.aarch64",
                           product_id: "python313-Flask-Security-5.5.2-1.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python310-Flask-Security-5.5.2-1.1.ppc64le",
                        product: {
                           name: "python310-Flask-Security-5.5.2-1.1.ppc64le",
                           product_id: "python310-Flask-Security-5.5.2-1.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python311-Flask-Security-5.5.2-1.1.ppc64le",
                        product: {
                           name: "python311-Flask-Security-5.5.2-1.1.ppc64le",
                           product_id: "python311-Flask-Security-5.5.2-1.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python312-Flask-Security-5.5.2-1.1.ppc64le",
                        product: {
                           name: "python312-Flask-Security-5.5.2-1.1.ppc64le",
                           product_id: "python312-Flask-Security-5.5.2-1.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python313-Flask-Security-5.5.2-1.1.ppc64le",
                        product: {
                           name: "python313-Flask-Security-5.5.2-1.1.ppc64le",
                           product_id: "python313-Flask-Security-5.5.2-1.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python310-Flask-Security-5.5.2-1.1.s390x",
                        product: {
                           name: "python310-Flask-Security-5.5.2-1.1.s390x",
                           product_id: "python310-Flask-Security-5.5.2-1.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python311-Flask-Security-5.5.2-1.1.s390x",
                        product: {
                           name: "python311-Flask-Security-5.5.2-1.1.s390x",
                           product_id: "python311-Flask-Security-5.5.2-1.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python312-Flask-Security-5.5.2-1.1.s390x",
                        product: {
                           name: "python312-Flask-Security-5.5.2-1.1.s390x",
                           product_id: "python312-Flask-Security-5.5.2-1.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python313-Flask-Security-5.5.2-1.1.s390x",
                        product: {
                           name: "python313-Flask-Security-5.5.2-1.1.s390x",
                           product_id: "python313-Flask-Security-5.5.2-1.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python310-Flask-Security-5.5.2-1.1.x86_64",
                        product: {
                           name: "python310-Flask-Security-5.5.2-1.1.x86_64",
                           product_id: "python310-Flask-Security-5.5.2-1.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python311-Flask-Security-5.5.2-1.1.x86_64",
                        product: {
                           name: "python311-Flask-Security-5.5.2-1.1.x86_64",
                           product_id: "python311-Flask-Security-5.5.2-1.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python312-Flask-Security-5.5.2-1.1.x86_64",
                        product: {
                           name: "python312-Flask-Security-5.5.2-1.1.x86_64",
                           product_id: "python312-Flask-Security-5.5.2-1.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python313-Flask-Security-5.5.2-1.1.x86_64",
                        product: {
                           name: "python313-Flask-Security-5.5.2-1.1.x86_64",
                           product_id: "python313-Flask-Security-5.5.2-1.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "python310-Flask-Security-5.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
            },
            product_reference: "python310-Flask-Security-5.5.2-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python310-Flask-Security-5.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
            },
            product_reference: "python310-Flask-Security-5.5.2-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python310-Flask-Security-5.5.2-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
            },
            product_reference: "python310-Flask-Security-5.5.2-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python310-Flask-Security-5.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
            },
            product_reference: "python310-Flask-Security-5.5.2-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python311-Flask-Security-5.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
            },
            product_reference: "python311-Flask-Security-5.5.2-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python311-Flask-Security-5.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
            },
            product_reference: "python311-Flask-Security-5.5.2-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python311-Flask-Security-5.5.2-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
            },
            product_reference: "python311-Flask-Security-5.5.2-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python311-Flask-Security-5.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
            },
            product_reference: "python311-Flask-Security-5.5.2-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python312-Flask-Security-5.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
            },
            product_reference: "python312-Flask-Security-5.5.2-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python312-Flask-Security-5.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
            },
            product_reference: "python312-Flask-Security-5.5.2-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python312-Flask-Security-5.5.2-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
            },
            product_reference: "python312-Flask-Security-5.5.2-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python312-Flask-Security-5.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
            },
            product_reference: "python312-Flask-Security-5.5.2-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python313-Flask-Security-5.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
            },
            product_reference: "python313-Flask-Security-5.5.2-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python313-Flask-Security-5.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
            },
            product_reference: "python313-Flask-Security-5.5.2-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python313-Flask-Security-5.5.2-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
            },
            product_reference: "python313-Flask-Security-5.5.2-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python313-Flask-Security-5.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64",
            },
            product_reference: "python313-Flask-Security-5.5.2-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2021-21241",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21241",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21241",
               url: "https://www.suse.com/security/cve/CVE-2021-21241",
            },
            {
               category: "external",
               summary: "SUSE Bug 1181058 for CVE-2021-21241",
               url: "https://bugzilla.suse.com/1181058",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-06T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-21241",
      },
      {
         cve: "CVE-2021-23385",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-23385",
            },
         ],
         notes: [
            {
               category: "general",
               text: "This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-23385",
               url: "https://www.suse.com/security/cve/CVE-2021-23385",
            },
            {
               category: "external",
               summary: "SUSE Bug 1202105 for CVE-2021-23385",
               url: "https://bugzilla.suse.com/1202105",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-06T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-23385",
      },
      {
         cve: "CVE-2023-49438",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-49438",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
               "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-49438",
               url: "https://www.suse.com/security/cve/CVE-2023-49438",
            },
            {
               category: "external",
               summary: "SUSE Bug 1218412 for CVE-2023-49438",
               url: "https://bugzilla.suse.com/1218412",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
                  "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-06T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2023-49438",
      },
   ],
}

{
   affected: [
      {
         package: {
            ecosystem: "PyPI",
            name: "Flask-Security-Too",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "3.3.0",
                  },
                  {
                     fixed: "3.4.5",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2021-21241",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-352",
      ],
      github_reviewed: true,
      github_reviewed_at: "2021-01-11T20:32:44Z",
      nvd_published_at: "2021-01-11T21:15:00Z",
      severity: "HIGH",
   },
   details: "### Issue\nThe  /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token.\n\n### Patches\nVersion 3.4.5 and soon to be released 4.0.0 are patched.\n\n### Workarounds\nIf you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.\n\n### References\nNone",
   id: "GHSA-hh7m-rx4f-4vpv",
   modified: "2024-09-20T17:48:13Z",
   published: "2021-01-11T20:38:28Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2021-21241",
      },
      {
         type: "WEB",
         url: "https://github.com/pypa/advisory-database/tree/main/vulns/flask-security-too/PYSEC-2021-91.yaml",
      },
      {
         type: "WEB",
         url: "https://pypi.org/project/Flask-Security-Too",
      },
      {
         type: "WEB",
         url: "https://web.archive.org/web/20210118165844/https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5",
      },
      {
         type: "WEB",
         url: "https://web.archive.org/web/20210118165958/https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a",
      },
      {
         type: "WEB",
         url: "https://web.archive.org/web/20210118170445/https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f",
      },
      {
         type: "WEB",
         url: "https://web.archive.org/web/20210118170502/https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv",
      },
      {
         type: "WEB",
         url: "https://web.archive.org/web/20211207005640/https://github.com/Flask-Middleware/flask-security/pull/422",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
         type: "CVSS_V3",
      },
      {
         score: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
         type: "CVSS_V4",
      },
   ],
   summary: "CSRF can expose users authentication token",
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:flask-security-too_project:flask-security-too:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6955F0BE-FEE7-4B0E-B488-FA537F6B068C",
                     versionEndExcluding: "3.4.5",
                     versionStartIncluding: "3.3.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.",
      },
      {
         lang: "es",
         value: "El paquete Python \"Flask-Security-Too\" es usado para agregar funcionalidades de seguridad a su aplicación Flask. Es una versión mantenida independientemente de Flask-Security basada en la versión 3.0.0 de Flask-Security. En Flask-Security-Too desde la versión 3.3.0 y versiones anteriores a 3.4.5, los endpoints /login y /change pueden devolver el token de autenticación del usuario autenticado en respuesta a una petición GET. Dado que las peticiones GET no están protegidas con un token CSRF, esto podría conllevar a que un sitio de terceros malicioso adquiera el token de autenticación. La versión 3.4.5 y la versión 4.0.0 están parcheadas. Como solución temporal, si no está utilizando tokens de autenticación, puede establecer el SECURITY_TOKEN_MAX_AGE en \"0\" (segundos), lo que debería inutilizar el token",
      },
   ],
   id: "CVE-2021-21241",
   lastModified: "2024-11-21T05:47:50.773",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.4,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 4,
            source: "security-advisories@github.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.4,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-01-11T21:15:13.377",
   references: [
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Flask-Middleware/flask-security/pull/422",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Product",
            "Third Party Advisory",
         ],
         url: "https://pypi.org/project/Flask-Security-Too",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Flask-Middleware/flask-security/pull/422",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Product",
            "Third Party Advisory",
         ],
         url: "https://pypi.org/project/Flask-Security-Too",
      },
   ],
   sourceIdentifier: "security-advisories@github.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-352",
            },
         ],
         source: "security-advisories@github.com",
         type: "Primary",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for python-Flask-Security-Too",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for python-Flask-Security-Too fixes the following issues:\n\n- CVE-2021-21241: Fixed an issue where GET requests lacking CSRF\n  protection to certain endpoints could return the user's\n  authentication token (bsc#1181058).\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2022-3093,SUSE-SLE-Module-Basesystem-15-SP3-2022-3093,SUSE-SLE-Module-Basesystem-15-SP4-2022-3093,SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3093,SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3093,SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3093,SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3093,SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3093,SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3093,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3093,SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3093,SUSE-Storage-7-2022-3093,openSUSE-SLE-15.3-2022-3093,openSUSE-SLE-15.4-2022-3093",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3093-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2022:3093-1",
            url: "https://www.suse.com/support/update/announcement/2022/suse-su-20223093-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2022:3093-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2022-September/012106.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1181058",
            url: "https://bugzilla.suse.com/1181058",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21241 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21241/",
         },
      ],
      title: "Security update for python-Flask-Security-Too",
      tracking: {
         current_release_date: "2022-09-06T05:52:18Z",
         generator: {
            date: "2022-09-06T05:52:18Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2022:3093-1",
         initial_release_date: "2022-09-06T05:52:18Z",
         revision_history: [
            {
               date: "2022-09-06T05:52:18Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                        product: {
                           name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                           product_id: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Basesystem 15 SP3",
                        product: {
                           name: "SUSE Linux Enterprise Module for Basesystem 15 SP3",
                           product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP3",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-basesystem:15:sp3",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                        product: {
                           name: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                           product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-basesystem:15:sp4",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                        product: {
                           name: "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                           product_id: "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle_hpc-espos:15:sp2",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                        product: {
                           name: "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                           product_id: "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle_hpc-ltss:15:sp2",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 15 SP2-BCL",
                        product: {
                           name: "SUSE Linux Enterprise Server 15 SP2-BCL",
                           product_id: "SUSE Linux Enterprise Server 15 SP2-BCL",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_bcl:15:sp2",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 15 SP2-LTSS",
                        product: {
                           name: "SUSE Linux Enterprise Server 15 SP2-LTSS",
                           product_id: "SUSE Linux Enterprise Server 15 SP2-LTSS",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles-ltss:15:sp2",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                        product: {
                           name: "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                           product_id: "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_sap:15:sp2",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Manager Proxy 4.1",
                        product: {
                           name: "SUSE Manager Proxy 4.1",
                           product_id: "SUSE Manager Proxy 4.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:suse-manager-proxy:4.1",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Manager Retail Branch Server 4.1",
                        product: {
                           name: "SUSE Manager Retail Branch Server 4.1",
                           product_id: "SUSE Manager Retail Branch Server 4.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:suse-manager-retail-branch-server:4.1",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Manager Server 4.1",
                        product: {
                           name: "SUSE Manager Server 4.1",
                           product_id: "SUSE Manager Server 4.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:suse-manager-server:4.1",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Enterprise Storage 7",
                        product: {
                           name: "SUSE Enterprise Storage 7",
                           product_id: "SUSE Enterprise Storage 7",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:ses:7",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.3",
                        product: {
                           name: "openSUSE Leap 15.3",
                           product_id: "openSUSE Leap 15.3",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.3",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.4",
                        product: {
                           name: "openSUSE Leap 15.4",
                           product_id: "openSUSE Leap 15.4",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.4",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
               product_id: "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
               product_id: "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-BCL",
               product_id: "SUSE Linux Enterprise Server 15 SP2-BCL:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 15 SP2-BCL",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
               product_id: "SUSE Linux Enterprise Server 15 SP2-LTSS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 15 SP2-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 15 SP2:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Manager Proxy 4.1",
               product_id: "SUSE Manager Proxy 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Manager Proxy 4.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Manager Retail Branch Server 4.1",
               product_id: "SUSE Manager Retail Branch Server 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Manager Retail Branch Server 4.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Manager Server 4.1",
               product_id: "SUSE Manager Server 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Manager Server 4.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of SUSE Enterprise Storage 7",
               product_id: "SUSE Enterprise Storage 7:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "SUSE Enterprise Storage 7",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            },
            product_reference: "python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2021-21241",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21241",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Enterprise Storage 7:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "SUSE Linux Enterprise Server 15 SP2-BCL:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "SUSE Linux Enterprise Server 15 SP2-LTSS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 15 SP2:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "SUSE Manager Proxy 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "SUSE Manager Retail Branch Server 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "SUSE Manager Server 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "openSUSE Leap 15.3:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               "openSUSE Leap 15.4:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21241",
               url: "https://www.suse.com/security/cve/CVE-2021-21241",
            },
            {
               category: "external",
               summary: "SUSE Bug 1181058 for CVE-2021-21241",
               url: "https://bugzilla.suse.com/1181058",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Enterprise Storage 7:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise Server 15 SP2-BCL:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise Server 15 SP2-LTSS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 15 SP2:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Manager Proxy 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Manager Retail Branch Server 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Manager Server 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "openSUSE Leap 15.3:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "openSUSE Leap 15.4:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Enterprise Storage 7:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise Server 15 SP2-BCL:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise Server 15 SP2-LTSS:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 15 SP2:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Manager Proxy 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Manager Retail Branch Server 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "SUSE Manager Server 4.1:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "openSUSE Leap 15.3:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
                  "openSUSE Leap 15.4:python3-Flask-Security-Too-3.4.2-150200.3.3.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-09-06T05:52:18Z",
               details: "important",
            },
         ],
         title: "CVE-2021-21241",
      },
   ],
}

{
   GSD: {
      alias: "CVE-2021-21241",
      description: "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.",
      id: "GSD-2021-21241",
      references: [
         "https://www.suse.com/security/cve/CVE-2021-21241.html",
         "https://security.archlinux.org/CVE-2021-21241",
      ],
   },
   gsd: {
      metadata: {
         exploitCode: "unknown",
         remediation: "unknown",
         reportConfidence: "confirmed",
         type: "vulnerability",
      },
      osvSchema: {
         aliases: [
            "CVE-2021-21241",
         ],
         details: "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.",
         id: "GSD-2021-21241",
         modified: "2023-12-13T01:23:10.895844Z",
         schema_version: "1.4.0",
      },
   },
   namespaces: {
      "cve.org": {
         CVE_data_meta: {
            ASSIGNER: "security-advisories@github.com",
            ID: "CVE-2021-21241",
            STATE: "PUBLIC",
            TITLE: "CSRF can expose users authentication token in Flask-Security-Too",
         },
         affects: {
            vendor: {
               vendor_data: [
                  {
                     product: {
                        product_data: [
                           {
                              product_name: "flask-security-too",
                              version: {
                                 version_data: [
                                    {
                                       version_value: ">= 3.3.0, < 3.4.5",
                                    },
                                 ],
                              },
                           },
                        ],
                     },
                     vendor_name: "Flask-Middleware",
                  },
               ],
            },
         },
         data_format: "MITRE",
         data_type: "CVE",
         data_version: "4.0",
         description: {
            description_data: [
               {
                  lang: "eng",
                  value: "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.",
               },
            ],
         },
         impact: {
            cvss: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.4,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
               version: "3.1",
            },
         },
         problemtype: {
            problemtype_data: [
               {
                  description: [
                     {
                        lang: "eng",
                        value: "CWE-352: Cross-Site Request Forgery (CSRF)",
                     },
                  ],
               },
            ],
         },
         references: {
            reference_data: [
               {
                  name: "https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv",
                  refsource: "CONFIRM",
                  url: "https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv",
               },
               {
                  name: "https://github.com/Flask-Middleware/flask-security/pull/422",
                  refsource: "MISC",
                  url: "https://github.com/Flask-Middleware/flask-security/pull/422",
               },
               {
                  name: "https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f",
                  refsource: "MISC",
                  url: "https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f",
               },
               {
                  name: "https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a",
                  refsource: "MISC",
                  url: "https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a",
               },
               {
                  name: "https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5",
                  refsource: "MISC",
                  url: "https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5",
               },
               {
                  name: "https://pypi.org/project/Flask-Security-Too",
                  refsource: "MISC",
                  url: "https://pypi.org/project/Flask-Security-Too",
               },
            ],
         },
         source: {
            advisory: "GHSA-hh7m-rx4f-4vpv",
            discovery: "UNKNOWN",
         },
      },
      "gitlab.com": {
         advisories: [
            {
               affected_range: ">=3.3.0,<3.4.5",
               affected_versions: "All versions starting from 3.3.0 before 3.4.5",
               cvss_v2: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
               cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
               cwe_ids: [
                  "CWE-1035",
                  "CWE-352",
                  "CWE-937",
               ],
               date: "2021-01-19",
               description: "In Flask-Security-Too, the `/login` and `/change` endpoints can return the authenticated user's authentication token in response to a GET request.",
               fixed_versions: [
                  "3.4.5",
               ],
               identifier: "CVE-2021-21241",
               identifiers: [
                  "CVE-2021-21241",
                  "GHSA-hh7m-rx4f-4vpv",
               ],
               not_impacted: "All versions before 3.3.0, all versions starting from 3.4.5",
               package_slug: "pypi/Flask-Security-Too",
               pubdate: "2021-01-11",
               solution: "Upgrade to version 3.4.5 or above.",
               title: "Cross-Site Request Forgery (CSRF)",
               urls: [
                  "https://nvd.nist.gov/vuln/detail/CVE-2021-21241",
               ],
               uuid: "74c4cce2-723a-4933-bc9c-5f76e49daa8b",
            },
         ],
      },
      "nvd.nist.gov": {
         configurations: {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:flask-security-too_project:flask-security-too:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndExcluding: "3.4.5",
                        versionStartIncluding: "3.3.0",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
         cve: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21241",
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "en",
                     value: "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "en",
                           value: "CWE-352",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5",
                     refsource: "MISC",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5",
                  },
                  {
                     name: "https://pypi.org/project/Flask-Security-Too",
                     refsource: "MISC",
                     tags: [
                        "Product",
                        "Third Party Advisory",
                     ],
                     url: "https://pypi.org/project/Flask-Security-Too",
                  },
                  {
                     name: "https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f",
                     refsource: "MISC",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f",
                  },
                  {
                     name: "https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv",
                     refsource: "CONFIRM",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv",
                  },
                  {
                     name: "https://github.com/Flask-Middleware/flask-security/pull/422",
                     refsource: "MISC",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/Flask-Middleware/flask-security/pull/422",
                  },
                  {
                     name: "https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a",
                     refsource: "MISC",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a",
                  },
               ],
            },
         },
         impact: {
            baseMetricV2: {
               acInsufInfo: false,
               cvssV2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               exploitabilityScore: 8.6,
               impactScore: 2.9,
               obtainAllPrivilege: false,
               obtainOtherPrivilege: false,
               obtainUserPrivilege: false,
               severity: "MEDIUM",
               userInteractionRequired: true,
            },
            baseMetricV3: {
               cvssV3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               exploitabilityScore: 2.8,
               impactScore: 4,
            },
         },
         lastModifiedDate: "2021-01-19T15:43Z",
         publishedDate: "2021-01-11T21:15Z",
      },
   },
}