mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2025-07-19 15:29:08 +02:00
dadb8790bd
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the
`Access-Control-Allow-Private-Network` CORS header to be set to true
by default, without any configuration option. This behavior can expose
private network resources to unauthorized external access, leading to
significant security risks such as data breaches, unauthorized access
to sensitive information, and potential network intrusions.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-6221
Upsteam-Patch:
7ae310c56a
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
21 lines
596 B
BlitzBasic
21 lines
596 B
BlitzBasic
HOMEPAGE = "https://pypi.python.org/pypi/Flask-Cors/"
|
|
SUMMARY = "A Flask extension adding a decorator for CORS support"
|
|
DESCRIPTION = "\
|
|
A Flask extension for handling Cross Origin Resource Sharing (CORS), making cross-origin AJAX possible \
|
|
"
|
|
SECTION = "devel/python"
|
|
LICENSE = "MIT"
|
|
LIC_FILES_CHKSUM = "file://LICENSE;md5=118fecaa576ab51c1520f95e98db61ce"
|
|
|
|
PYPI_PACKAGE = "Flask-Cors"
|
|
|
|
SRC_URI += " \
|
|
file://CVE-2024-6221.patch \
|
|
"
|
|
|
|
SRC_URI[sha256sum] = "f268522fcb2f73e2ecdde1ef45e2fd5c71cc48fe03cffb4b441c6d1b40684eb0"
|
|
|
|
inherit pypi setuptools3
|
|
|
|
RDEPENDS:${PN} += "python3-flask"
|