Update dependency flask to v0.12.3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
flask (changelog)	==0.12.2 → ==0.12.3

---

Flask is vulnerable to Denial of Service via incorrect encoding of JSON data

CVE-2018-1000656 / GHSA-562c-5r94-xh97

More information

Details

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000656
• https://github.com/pallets/flask/pull/2691
• https://github.com/advisories/GHSA-562c-5r94-xh97
• https://github.com/pallets/flask/releases/tag/0.12.3
• https://lists.debian.org/debian-lts-announce/2019/08/msg00025.html
• https://github.com/pallets/flask/commit/b178e89e4456e777b1a7ac6d7199052d0dfdbbbe
• https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2018-66.yaml
• https://security.netapp.com/advisory/ntap-20190221-0001
• https://usn.ubuntu.com/4378-1

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pallets/flask (flask)

v0.12.3

Compare Source

Released 2018-04-26

• Request.get_json no longer accepts arbitrary encodings.
  Incoming JSON should be encoded using UTF-8 per :rfc:8259, but
  Flask will autodetect UTF-8, -16, or -32. :issue:2692
• Fix a Python warning about imports when using python -m flask.
  :issue:2666
• Fix a ValueError caused by invalid Range requests in some
  cases.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request