{"document":{"aggregate_severity":{"namespace":"https://www.suse.com/support/security/rating/","text":"moderate"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright 2024 SUSE LLC. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"Security update for python-Flask","title":"Title of the patch"},{"category":"description","text":"This update for python-Flask fixes the following issue:\n\n- CVE-2026-27205: information disclosure due to Flask session not adding the `Vary: Cookie` header (bsc#1258700).\n","title":"Description of the patch"},{"category":"details","text":"SUSE-2026-849,SUSE-SLE-Module-Python3-15-SP7-2026-849,openSUSE-SLE-15.6-2026-849","title":"Patchnames"},{"category":"legal_disclaimer","text":"CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).","title":"Terms of use"}],"publisher":{"category":"vendor","contact_details":"https://www.suse.com/support/security/contact/","name":"SUSE Product Security Team","namespace":"https://www.suse.com/"},"references":[{"category":"external","summary":"SUSE ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"self","summary":"URL of this CSAF notice","url":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0849-1.json"},{"category":"self","summary":"URL for SUSE-SU-2026:0849-1","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260849-1/"},{"category":"self","summary":"E-Mail link for SUSE-SU-2026:0849-1","url":"https://lists.suse.com/pipermail/sle-security-updates/2026-March/024661.html"},{"category":"self","summary":"SUSE Bug 1258700","url":"https://bugzilla.suse.com/1258700"},{"category":"self","summary":"SUSE CVE CVE-2026-27205 page","url":"https://www.suse.com/security/cve/CVE-2026-27205/"}],"title":"Security update for python-Flask","tracking":{"current_release_date":"2026-03-09T10:13:40Z","generator":{"date":"2026-03-09T10:13:40Z","engine":{"name":"cve-database.git:bin/generate-csaf.pl","version":"1"}},"id":"SUSE-SU-2026:0849-1","initial_release_date":"2026-03-09T10:13:40Z","revision_history":[{"date":"2026-03-09T10:13:40Z","number":"1","summary":"Current version"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"python311-Flask-2.3.2-150400.3.9.1.noarch","product":{"name":"python311-Flask-2.3.2-150400.3.9.1.noarch","product_id":"python311-Flask-2.3.2-150400.3.9.1.noarch"}},{"category":"product_version","name":"python311-Flask-doc-2.3.2-150400.3.9.1.noarch","product":{"name":"python311-Flask-doc-2.3.2-150400.3.9.1.noarch","product_id":"python311-Flask-doc-2.3.2-150400.3.9.1.noarch"}}],"category":"architecture","name":"noarch"},{"branches":[{"category":"product_name","name":"SUSE Linux Enterprise Module for Python 3 15 SP7","product":{"name":"SUSE Linux Enterprise Module for Python 3 15 SP7","product_id":"SUSE Linux Enterprise Module for Python 3 15 SP7","product_identification_helper":{"cpe":"cpe:/o:suse:sle-module-python3:15:sp7"}}},{"category":"product_name","name":"openSUSE Leap 15.6","product":{"name":"openSUSE Leap 15.6","product_id":"openSUSE Leap 15.6","product_identification_helper":{"cpe":"cpe:/o:opensuse:leap:15.6"}}}],"category":"product_family","name":"SUSE Linux Enterprise"}],"category":"vendor","name":"SUSE"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"python311-Flask-2.3.2-150400.3.9.1.noarch as component of SUSE Linux Enterprise Module for Python 3 15 SP7","product_id":"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-Flask-2.3.2-150400.3.9.1.noarch"},"product_reference":"python311-Flask-2.3.2-150400.3.9.1.noarch","relates_to_product_reference":"SUSE Linux Enterprise Module for Python 3 15 SP7"},{"category":"default_component_of","full_product_name":{"name":"python311-Flask-2.3.2-150400.3.9.1.noarch as component of openSUSE Leap 15.6","product_id":"openSUSE Leap 15.6:python311-Flask-2.3.2-150400.3.9.1.noarch"},"product_reference":"python311-Flask-2.3.2-150400.3.9.1.noarch","relates_to_product_reference":"openSUSE Leap 15.6"},{"category":"default_component_of","full_product_name":{"name":"python311-Flask-doc-2.3.2-150400.3.9.1.noarch as component of openSUSE Leap 15.6","product_id":"openSUSE Leap 15.6:python311-Flask-doc-2.3.2-150400.3.9.1.noarch"},"product_reference":"python311-Flask-doc-2.3.2-150400.3.9.1.noarch","relates_to_product_reference":"openSUSE Leap 15.6"}]},"vulnerabilities":[{"cve":"CVE-2026-27205","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-27205"}],"notes":[{"category":"general","text":"Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Module for Python 3 15 SP7:python311-Flask-2.3.2-150400.3.9.1.noarch","openSUSE Leap 15.6:python311-Flask-2.3.2-150400.3.9.1.noarch","openSUSE Leap 15.6:python311-Flask-doc-2.3.2-150400.3.9.1.noarch"]},"references":[{"category":"external","summary":"CVE-2026-27205","url":"https://www.suse.com/security/cve/CVE-2026-27205"},{"category":"external","summary":"SUSE Bug 1258700 for CVE-2026-27205","url":"https://bugzilla.suse.com/1258700"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Module for Python 3 15 SP7:python311-Flask-2.3.2-150400.3.9.1.noarch","openSUSE Leap 15.6:python311-Flask-2.3.2-150400.3.9.1.noarch","openSUSE Leap 15.6:python311-Flask-doc-2.3.2-150400.3.9.1.noarch"]}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["SUSE Linux Enterprise Module for Python 3 15 SP7:python311-Flask-2.3.2-150400.3.9.1.noarch","openSUSE Leap 15.6:python311-Flask-2.3.2-150400.3.9.1.noarch","openSUSE Leap 15.6:python311-Flask-doc-2.3.2-150400.3.9.1.noarch"]}],"threats":[{"category":"impact","date":"2026-03-09T10:13:40Z","details":"moderate"}],"title":"CVE-2026-27205"}]}