Deserialization of Untrusted Data - CVE-2021-33026

[gord0b]

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The Flask-Caching extension for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code.

Full Details: https://security.snyk.io/vuln/SNYK-PYTHON-FLASKCACHING-1292339
CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33026
Other Details: https://snyk.io/vuln/pip%3Aflask-caching

Environment:

• Flask-Caching version: 1.10.1

[northernSage]

Thanks for taking the time to reach out, but this has been extensively discussed in #209 and we already offer ways of avoiding pickle with custom serializer support.