Arch Linux Security Advisory ASA-202105-2 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-21241 Package : python-flask-security-too Type : cross-site request forgery Remote : Yes Link : https://security.archlinux.org/AVG-1434 Summary ======= The package python-flask-security-too before version 4.0.1-1 is vulnerable to cross-site request forgery. Resolution ========== Upgrade to 4.0.1-1. # pacman -Syu "python-flask-security-too>=4.0.1-1" The problem has been fixed upstream in version 4.0.1. Workaround ========== If you aren't using authentication tokens, you can set SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. Description =========== In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. Impact ====== A remote attacker could obtain a user's authentication token from a cross-site request. References ========== https://bugs.archlinux.org/task/70041 https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-... https://github.com/Flask-Middleware/flask-security/issues/421 https://github.com/Flask-Middleware/flask-security/pull/422 https://github.com/Flask-Middleware/flask-security/commit/c05afe837e83f20f59... https://security.archlinux.org/CVE-2021-21241