[Git][security-tracker-team/security-tracker][master] Update information for CVE-2024-6839

[Daniel Leidert (@dleidert)]

Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
552a7c71 by Daniel Leidert at 2025-05-31T02:41:05+02:00
Update information for CVE-2024-6839

The patch in version 6.0.0 was not complete. And due to the new test not
running because of a naming issue, it has been missed. There is a new PR to fix
both, the filename and the code. It still seems to be a minor issue; thus the
postponed seems to be justified still.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -23970,8 +23970,12 @@ CVE-2024-6841 (A Cross-Site Request Forgery (CSRF) vulnerability exists in the l
 	NOT-FOR-US: Vanna-ai
 CVE-2024-6839 (corydolphin/flask-cors version 4.0.1 contains an improper regex path m ...)
 	- python-flask-cors 6.0.0-1 (bug #1100988)
-	[bookworm] - python-flask-cors <postponed> (Minor issue, revisit when fixed upstream)
+	[bookworm] - python-flask-cors <postponed> (Minor issue)
+	[bullseye] - python-flask-cors <postponed> (Minor issue)
 	NOTE: https://huntr.com/bounties/403eb1fc-86f4-4820-8eba-0f3dfae9f2b4
+	NOTE: https://github.com/advisories/GHSA-7rxf-gvfg-47g4
+	NOTE: https://github.com/corydolphin/flask-cors/commit/e970988bea563e05e8b8f53fa7bcc134b5bf5c5f (6.0.0, incomplete fix)
+	NOTE: https://github.com/corydolphin/flask-cors/pull/392 (follow-up for incomplete fix)
 CVE-2024-6838 (In mlflow/mlflow version v2.13.2, a vulnerability exists that allows t ...)
 	NOT-FOR-US: mlflow
 CVE-2024-6829 (A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to e ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/552a7c711d2c83226e289b7c489d6059ed194c6d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/552a7c711d2c83226e289b7c489d6059ed194c6d
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250531/ca654960/attachment.htm>