Debian Flask-Security vulnerabilities

CVE-2023-49438 [MEDIUM] CWE-601 Flask-Security has an Open Redirect issue Flask-Security has an Open Redirect issue # Open Redirect in Flask-Security ## Summary `flask_security.utils.validate_redirect_url()` can allow an attacker-controlled redirect URL when subdomain redirects are enabled. The bypass uses a backslash inside the URL authority/host: ```text http://evil.com\.whitelist.com http://evil.com%5C.whitelist.com ``` Python's `urlsplit()` parses the full authority as `evil.com\.white

CVE-2021-21241 [HIGH] CVE-2021-21241: flask-security - The Python "Flask-Security-Too" package is used for adding security features to ... The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentica

CVE-2021-23385 [MEDIUM] CVE-2021-23385: flask-security - This affects all versions of package Flask-Security. When using the get_post_log... This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkze