crítica
CVE-2021-33026
The Flask-Caching extension through 1.10.1 for Flask relies on Pickle ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA4.2CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (media).
Descripción
The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | flask-caching | sin corrección indicada |
| debian 12 | flask-caching | sin corrección indicada |
| debian 13 | flask-caching | sin corrección indicada |
| debian 14 | flask-caching | sin corrección indicada |
| echo | flask-caching | sin corrección indicada |
| pip::GitHub Security Advisory pip | flask-caching | sin corrección indicada |
| rapidfort debian 12 | flask-caching | sin corrección indicada |
| rapidfort debian 13 | flask-caching | sin corrección indicada |
Referencias
- https://github.com/advisories/GHSA-656c-6cxf-hvcv
- https://github.com/pallets-eco/flask-caching/pull/209#issuecomment-1136397937
- https://github.com/pypa/advisory-database/tree/main/vulns/flask-caching/PYSEC-2021-13.yaml
- https://github.com/sh4nks/flask-caching
- https://github.com/sh4nks/flask-caching/pull/209
- https://nvd.nist.gov/vuln/detail/CVE-2021-33026