CVE-2019-14806

Advisory

Candig-server 1.0.2 updates 'WerkZeug' to v0.15.5 to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This is a security and bug fix release.

This release introduces:

- Updated WerkZeug to 0.15.5 to resolve its security vulnerabilities.
- Updated Dockerfile.
- Updated server_info page.
- Updated gff3_db generate script to include a `CREATE INDEX` command.
- Renamed default db path for `Development config` to `candig-example-data`, this change is not backward compatible. Local test servers that are using this config should rename their db path as soon as possble. Such config should not be used for production environment.

This is an intermediate release before the release v1.1.0, whose progress is available from https://github.com/CanDIG/candig-server/projects/2

Resources

• https://pypi.org/project/candig-server
• https://pyup.io/changelogs/candig-server/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14806