[Pkg-privacy-maintainers] Bug#1150205: Bug#1150205: AttributeError: property 'session' of 'RequestContext' object has no setter

[Hefee]

Control: reassign -1 flask 3.1.1-1+deb13u1
Control: tags -1 trixie
Control: affects -1 onionshare

Hey,

this is an issue in flask/flask-socketio an not in onionshare itself. 

And was introduced by fixing  CVE-2026-27205 within flask by backport:
https://sources.debian.org/src/flask/3.1.1-1%2Bdeb13u1/debian/patches/
CVE-2026-27205-request-context-tracks-session-access.patch

The problem is, that a commit from 3.1.3 got backported, that changes the API 
of flask, that is used by flask-socketio. With the fix for CVE-2026-27205 it 
would need to write to _session. flask-socketio has fixed that with 5.6.1. The 
relevant hunk is:
https://github.com/miguelgrinberg/Flask-SocketIO/commit/
956f8f2847c53d5156620b395912b7c916e15a1b#diff-
d4032ca32e5dce64b1e46683f4bc8544ccefadb6e8f3e09a62152dda9c0a0578L815

This issue was reported two times already for unstable with
flask-socketio < 5.6 and  flask > 3.1.1:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132356
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136892

How we now do a follow-up? We actually need a pu for flask-socketio, or any 
other ideas?

Regards,

hefee

--

On Mittwoch, 7. Oktober 2026 05:05 momfox67 wrote:
> Package: onionshare-cli
> Version: 2.6.3-1+deb13u2
> Severity: normal
> 
> Dear Maintainer,
> 
> running the following command:
> 
> onionshare-cli --chat
> 
> then connecting to the .onion link it outputs with the key it outputs, then
> trying to type in the chat window gives the following error message and
> fails to display the connection message or the typed chat message,
> rendering the chat functionality completely unusable. share and receive
> seem unaffected so far as i can discern - only chat is obviously broken
> 
> Traceback (most recent call last):
>   File "/usr/lib/python3/dist-packages/engineio/server.py", line 450, in
> run_handler return self.handlers[event](*args)
>            ~~~~~~~~~~~~~~~~~~~~^^^^^^^
>   File "/usr/lib/python3/dist-packages/socketio/server.py", line 652, in
> _handle_eio_message self._handle_connect(eio_sid, pkt.namespace, pkt.data)
>     ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>   File "/usr/lib/python3/dist-packages/socketio/server.py", line 538, in
> _handle_connect success = self._trigger_event(
>         'connect', namespace, sid, self.environ[eio_sid])
>   File "/usr/lib/python3/dist-packages/socketio/server.py", line 617, in
> _trigger_event return handler(*args)
>   File "/usr/lib/python3/dist-packages/flask_socketio/__init__.py", line
> 292, in _handler return self._handle_event(handler, message, real_ns, sid,
>            ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>                               *args)
>                               ^^^^^^
>   File "/usr/lib/python3/dist-packages/flask_socketio/__init__.py", line
> 816, in _handle_event ctx.session = session_obj
>     ^^^^^^^^^^^
> AttributeError: property 'session' of 'RequestContext' object has no setter
> 
> -- System Information:
> Debian Release: 13.7
>   APT prefers stable-updates
>   APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
> 'stable') Architecture: amd64 (x86_64)
> 
> _______________________________________________
> Pkg-privacy-maintainers mailing list
> Pkg-privacy-maintainers at alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-privacy-maintai
> ners

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-privacy-maintainers/attachments/20261013/e34e5b14/attachment.sig>