—

PYSEC-2020-156

Quick fix

PYSEC-2020-156 — webargs: upgrade to the fixed version with the command below.

pip install --upgrade 'webargs>=5.5.3'

Details

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made across domains, leading to CSRF.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/webargs

Introduced in: 5.0.0Fixed in: 5.5.3

Fixpip install --upgrade 'webargs>=5.5.3'

References

https://webargs.readthedocs.io/en/latest/changelog.html[WEB]
https://github.com/advisories/GHSA-fjq3-5pxw-4wj4[ADVISORY]