CVE-2021-23385

Name	CVE-2021-23385
Description	This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Note: Flask-Security is not maintained anymore.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3545-1
Debian Bugs	1021279

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
flask-security (PTS)	buster	1.7.5-2	vulnerable
	buster (security)	1.7.5-2+deb10u1	fixed
	bullseye	4.0.0-1+deb11u1	fixed
	bookworm	5.1.2-1	fixed
	sid, trixie	5.4.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
flask-security	source	buster	1.7.5-2+deb10u1	DLA-3545-1
flask-security	source	bullseye	4.0.0-1+deb11u1
flask-security	source	(unstable)	5.0.2-1		1021279

Notes

https://security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234
https://github.com/Flask-Middleware/flask-security/issues/724
https://github.com/Flask-Middleware/flask-security/issues/486
https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-6qmf-fj6m-686c
https://github.com/Flask-Middleware/flask-security/commit/e39bb04615050448c1b8ba4caa7dacc0edd3e405 (4.1.0)