ASA-202105-2 log generated external raw

[ASA-202105-2] python-flask-security-too: cross-site request forgery
Arch Linux Security Advisory ASA-202105-2 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-21241 Package : python-flask-security-too Type : cross-site request forgery Remote : Yes Link : Summary ======= The package python-flask-security-too before version 4.0.1-1 is vulnerable to cross-site request forgery. Resolution ========== Upgrade to 4.0.1-1. # pacman -Syu "python-flask-security-too>=4.0.1-1" The problem has been fixed upstream in version 4.0.1. Workaround ========== If you aren't using authentication tokens, you can set SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. Description =========== In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. Impact ====== A remote attacker could obtain a user's authentication token from a cross-site request. References ==========