Cryptographic issues in Flask - CVE-2025-47278

Vulnerability identifier: #VU109059

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N]

CVE-ID: CVE-2025-47278

CWE-ID: CWE-310

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to the way fallback key configuration was handled. The application used the last fallback key for signing, rather than the current signing key, which could potentially lead to data tampering.

Flask
QRadar Investigation Assistant
watsonx Orchestrate Developer Edition
Storage Defender - Resiliency Service
IBM Cloud Pak for Watson AIOps
Maximo Application Suite - Location Service for Esri Component
Maximo Application Suite - Predict Component
Maximo Application Suite - Visual Inspection Component
Netcool Operations Insight
IBM Fusion HCI
IBM Maximo Application Suite
Ubuntu
Fedora
flask (Ubuntu package)
mingw-python-flask
python-flask
mingw-python-flit-core

Install updates from vendor's website.

Flask - update to 3.1.1
QRadar Investigation Assistant - update to 1.1.0
watsonx Orchestrate Developer Edition - update to 1.13.0
Netcool Operations Insight - update to 1.6.15
Storage Defender - Resiliency Service - update to 2.0.14
IBM Fusion HCI - update to 2.11.0
IBM Cloud Pak for Watson AIOps - update to 4.10.0
IBM Maximo Application Suite - addressed in versions 8.10.29, 8.11.26, 9.0.15, 9.1.3
Maximo Application Suite - Predict Component - update to 9.0.7
Maximo Application Suite - Visual Inspection Component - update to 9.1.1
flask (Ubuntu package) - update to 3.1.0-2ubuntu1.1
mingw-python-flask - update to 3.1.1-1.fc42
python-flask - update to 3.1.2-2.fc42
mingw-python-flit-core - update to 3.12.0-1.fc42

• https://github.com/pallets/flask/security/advisories/GHSA-4grg-w6v8-c28g

• Incorrect usage of signing key in Flask
• Fedora 42 update for mingw-python-flask, mingw-python-flit-core
• Ubuntu update for flask
• IBM Maximo Application Suite - Predict Component update for Flask
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM QRadar Investigation Assistant
• Fedora 42 update for python-flask
• Multiple vulnerabilities in IBM Maximo Application Suite - Location Service for Esri Component
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in IBM Maximo Application Suite
• IBM Maximo Application Suite - Visual Inspection Component update for Flask
• IBM watsonx Orchestrate Developer Edition update for Flask
• Multiple vulnerabilities in Netcool Operations Insight