USN-7612-1: Flask-CORS vulnerabilities

Publication date

2 July 2025

Overview

Several security issues were fixed in Flask-CORS.


Packages

  • python-flask-cors - Flask extension for handling Cross Origin Resource Sharing (CORS)

Details

It was discovered that Flask-CORS did not correctly handle certain regular
expressions. A remote attacker could possibly use this issue to leak
sensitive information or bypass authentication mechanisms. (CVE-2024-6839)
It was discovered that Flask-CORS allowed certain CORS headers to be
enabled by default. A remote attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221) It was
discovered that Flask-CORS did not correctly handle case sensitivity when
matching paths. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-6866) It was discovered that Flask-CORS
did not correctly handle certain characters in URL paths. A remote attacker
could possibly use this issue to...

It was discovered that Flask-CORS did not correctly handle certain regular
expressions. A remote attacker could possibly use this issue to leak
sensitive information or bypass authentication mechanisms. (CVE-2024-6839)
It was discovered that Flask-CORS allowed certain CORS headers to be
enabled by default. A remote attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221) It was
discovered that Flask-CORS did not correctly handle case sensitivity when
matching paths. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-6866) It was discovered that Flask-CORS
did not correctly handle certain characters in URL paths. A remote attacker
could possibly use this issue to leak sensitive information or bypass
authentication mechanisms. (CVE-2024-6844) Elias Hohl was discovered that
Flask-CORS did not correctly sanitize log entries. A remote attacker could
possibly use this issue to corrupt log files. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-1681)


Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
25.04 plucky python3-flask-cors –  5.0.0-1ubuntu0.1
24.10 oracular python3-flask-cors –  4.0.1-1ubuntu0.1
24.04 noble python3-flask-cors –  4.0.0-1ubuntu0.1~esm1  
22.04 jammy python3-flask-cors –  3.0.9-2ubuntu0.1
20.04 focal python3-flask-cors –  3.0.8-2ubuntu0.1+esm1  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›