CVE-2024-1681

Advisory

Cornflow version 1.0.11 updates its `flask-cors` dependency from version 3.0.10 or lower to version 4.0.1 or lower in response to CVE-2024-1681.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

---------------

- released: 2024-05-10
- description: release to fix security vulnerabilities
- changelog:
- Upgraded flask-cors version to 4.0.1
- Upgraded Werkzeug version to 3.0.3
- Upgraded Airflow to version 2.9.1
- Fixed Werkzeug version on airflow image to 3.0.3

What's Changed
* Added codecov token for upload of results by ggsdc in https://github.com/baobabsoluciones/cornflow/pull/520
* Docs/update by ggsdc in https://github.com/baobabsoluciones/cornflow/pull/521
* Changes needed due to security reasons. by ggsdc in https://github.com/baobabsoluciones/cornflow/pull/529


**Full Changelog**: https://github.com/baobabsoluciones/cornflow/compare/v1.0.10...v1.0.11

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1681
• https://github.com/baobabsoluciones/cornflow/pull/529/files#diff-be5b6075179364549c9fadc87fdd5ccb669309ec84b294dba094fc911fee4b58L11