chore(deps): update dependency flask to v2.2.5 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
Flask (changelog)	==2.2.2 → ==2.2.5
Flask (changelog)	==1.1.4 → ==2.2.5

---

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

CVE-2023-30861 / GHSA-m2qf-hxjv-5gpq

More information

Details

When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
2. The application sets session.permanent = True.
3. The application does not access or modify the session at any point during a request.
4. SESSION_REFRESH_EACH_REQUEST is enabled (the default).
5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
• https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b
• https://github.com/pallets/flask/releases/tag/2.3.2
• https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965
• https://nvd.nist.gov/vuln/detail/CVE-2023-30861
• https://github.com/pallets/flask/releases/tag/2.2.5
• https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2023-62.yaml
• https://www.debian.org/security/2023/dsa-5442
• https://lists.debian.org/debian-lts-announce/2023/08/msg00024.html
• https://security.netapp.com/advisory/ntap-20230818-0006
• https://github.com/advisories/GHSA-m2qf-hxjv-5gpq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pallets/flask (Flask)

v2.2.5

Compare Source

Released 2023-05-02

• Update for compatibility with Werkzeug 2.3.3.
• Set Vary: Cookie header when the session is accessed, modified, or refreshed.

v2.2.4

Compare Source

Released 2023-04-25

• Update for compatibility with Werkzeug 2.3.

v2.2.3

Compare Source

Released 2023-02-15

• Autoescape is enabled by default for .svg template files. :issue:4831
• Fix the type of template_folder to accept pathlib.Path. :issue:4892
• Add --debug option to the flask run command. :issue:4777

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request upgrades the Flask dependency to version 2.2.5 across multiple requirements files. However, upgrading Flask in the appengine/flexible/websockets directory will break the application due to an incompatibility between Flask 2.0+ and the unmaintained Flask-Sockets library. It is recommended to exclude this directory from the upgrade or migrate to a maintained alternative like Flask-Sock.

[gemini-code-assist]

Upgrading Flask to 2.2.5 in this directory will break the application. As noted in the inline comment, Flask-Sockets is incompatible with Flask 2.0+ because it relies on internal APIs that were removed or changed. Since Flask-Sockets is unmaintained, you should exclude this directory from the Flask upgrade or migrate the sample to a maintained library like Flask-Sock before upgrading.

Flask==1.1.4 # it seems like Flask-sockets doesn't play well with 2.0+