Skip to content
Fencer Vulns
high 7.5

CVE-2023-30861 json

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

published 2023-05-01 3 y ago modified 2026-09-10 59 d ago also EUVD-2023-0080 , GHSA-m2qf-hxjv-5gpq , PYSEC-2023-62

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Patch / fix

  • pypi flask 2.2.5, 2.3.2
  • palletsprojects flask 2.2.5, 2.3.2
  • flask Debian 14, Debian 13, Debian 12 2.2.2-3

debian advisories DEBIAN-CVE-2023-30861

  • flask Ubuntu 20.04 LTS 1.1.1-2ubuntu0.1
  • flask Ubuntu 22.04 LTS 2.0.1-2ubuntu1.1

ubuntu advisories UBUNTU-CVE-2023-30861

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cri-o openshift 4.13 1.26.3-8.rhaos4.13.git9232b13.el8
  • cri-o openshift 4.13 1.26.3-9.rhaos4.13.git9232b13.el9
  • conmon openshift 4.13 3:2.1.7-1.1.rhaos4.13.el9
  • openshift openshift 4.13 4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8
  • openshift openshift 4.13 4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9
  • python-flask openshift ironic 4.13 2:2.0.1-4.el9.2
  • python3-flask openshift ironic 4.13 2:2.0.1-4.el9.2
  • NetworkManager openshift 4.13 1:1.42.2-2.el9_2

red hat advisories RHSA-2023:3536RHSA-2023:3545RHSA-2023:3541RHSA-2023:3440RHSA-2023:3444RHSA-2023:3446

  • python-Flask SLE Module for Basesystem 15 SP5, SLE Module for Basesystem 15 SP4, openSUSE Leap 15.5 +1 more 1.0.4-150400.3.3.1
  • python-Flask SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +14 more 1.0.2-150100.6.3.1

suse advisories SUSE-SU-2023:2263-2SUSE-SU-2023:2264-1SUSE-SU-2023:2263-1

  • python-Flask openSUSE Tumbleweed 3.1.3-3.1

opensuse advisories openSUSE-SU-2026:11902-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-30861 updated cvss 7.5

flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header

  • Red Hat Ceph Storage 3 python-flask
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 python3-flask Red Hat Storage 3 python-flask
    affected: no fix available
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.11 python-flask 1.1.2-6.el8, python3-flask 1.1.2-6.el8
    fixed: vendor fix RHSA-2023:3541
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.12 python-flask 2.0.1-3.el9, python3-flask 2.0.1-3.el9
    fixed: vendor fix RHSA-2023:3545
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 python-flask 2.0.1-4.el9.2, python3-flask 2.0.1-4.el9.2
    fixed: vendor fix RHSA-2023:3536
  • Red Hat Quay v3 quay/quay-rhel8 v3.10.0-150
    fixed: vendor fix RHSA-2023:7341
  • Red Hat Enterprise Linux 7 Extras python-flask 0.10.1-7.el7_9
    fixed: vendor fix RHSA-2023:3525
  • Red Hat OpenStack Platform 16.1 python-flask 1.0.2-8.el8ost, python3-flask 1.0.2-8.el8ost
    fixed: vendor fix RHSA-2023:3446
show 3 more
  • Red Hat OpenStack Platform 16.2 python-flask 1.0.2-8.el8ost, python3-flask 1.0.2-8.el8ost
    fixed: vendor fix RHSA-2023:3444
  • Red Hat OpenStack Platform 17.0 python-flask 1.1.2-6.el9ost, python3-flask 1.1.2-6.el9ost
    fixed: vendor fix RHSA-2023:3440
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.11 openstack-ironic 20.2.1-0.20230605115028.483a7f9.el8, openstack-ironic-api 20.2.1-0.20230605115028.483a7f9.el8, python3-ironic-tests 20.2.1-0.20230605115028.483a7f9.el8, openstack-ironic-common 20.2.1-0.20230605115028.483a7f9.el8, openstack-ironic-conductor 20.2.1-0.20230605115028.483a7f9.el8, openstack-ironic-dnsmasq-tftp-server 20.2.1-0.20230605115028.483a7f9.el8 Red Hat Quay v3 quay/clair-rhel8 v3.10.0-20, quay/quay-builder-rhel8 v3.10.0-17, quay/quay-operator-rhel8 v3.10.0-37, quay/quay-operator-bundle v3.10.0-154, quay/quay-builder-qemu-rhcos-rhel8 v3.10.0-10, quay/quay-container-security-operator-rhel8 v3.10.0-19, +1 more Red Hat Ceph Storage 7 python-flask Red Hat OpenShift Container Platform 4.11 cri-o 1.24.5-5.rhaos4.11.git8bf967b.el8, openshift 4.11.0-202305261554.p0.g38b1413.assembly.stream.el8, openshift-hyperkube 4.11.0-202305261554.p0.g38b1413.assembly.stream.el8 Red Hat OpenShift Container Platform 4.12 podman 4.2.0-4.1.rhaos4.12.el8, podman-tests 4.2.0-4.1.rhaos4.12.el8, podman-docker 4.2.0-4.1.rhaos4.12.el8, podman-remote 4.2.0-4.1.rhaos4.12.el8, podman-gvproxy 4.2.0-4.1.rhaos4.12.el8, podman-plugins 4.2.0-4.1.rhaos4.12.el8, +1 more Red Hat OpenShift Container Platform 4.13 NetworkManager 1.42.2-2.el9_2, conmon 2.1.7-1.1.rhaos4.13.el9, NetworkManager-ovs 1.42.2-2.el9_2, NetworkManager-ppp 1.42.2-2.el9_2, NetworkManager-tui 1.42.2-2.el9_2, NetworkManager-adsl 1.42.2-2.el9_2, +24 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

1.25% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi flask
>=2.3.0, <2.3.2
<2.2.5
2.3.2
2.2.5

Affected products

  • pallets flask

Classification

Weakness
  • CWE-539 Use of Persistent Cookies Containing Sensitive Information
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of pallets/flask published their own advisory on GitHub. Reviewed sources take precedence over it.