{
  "@id": "urn:uuid:ab959fa9-b3a0-46e5-94f8-ab25b0abe21a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T22:25:00.405081+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T22:25:00.405081+00:00",
      "status_notes": "Vulnerability CVE-2024-1681 does not affect version 5.0.1.post1+tuxcare of flask-cors. not_affected \u2014 CVE-2024-1681 (log injection via CRLF in request path) is NOT present in flask-cors 5.0.1.post1+tuxcare. The vulnerable code pattern (using '%s' format specifier to log request.path) was fixed by upstream commit 6172c2000dba965fedb8e9a8a916ad56f0fb2630 authored by Anes Hujevi\u0107 on May 4, 2024. This fix was included in the upstream 5.0.1 release before TuxCare onboarded the version on commit 16c3...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-1681"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-1681 (log injection via CRLF in request path) is NOT present in flask-cors 5.0.1.post1+tuxcare. The vulnerable code pattern (using '%s' format specifier to log request.path) was fixed by upstream commit 6172c2000dba965fedb8e9a8a916ad56f0fb2630 authored by Anes Hujevi\u0107 on May 4, 2024. This fix was included in the upstream 5.0.1 release before TuxCare onboarded the version on commit 16c3..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:13:55.687660+00:00",
      "status_notes": "Vulnerability CVE-2024-6221 affects version 5.0.1.post1+tuxcare of flask-cors.",
      "vulnerability": {
        "name": "CVE-2024-6221"
      },
      "action_statement": "Vulnerability CVE-2024-6221 affects version 5.0.1.post1+tuxcare of flask-cors."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6839 is fixed in version 5.0.1.post1+tuxcare of flask-cors.",
      "vulnerability": {
        "name": "CVE-2024-6839"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6844 is fixed in version 5.0.1.post1+tuxcare of flask-cors.",
      "vulnerability": {
        "name": "CVE-2024-6844"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6866 is fixed in version 5.0.1.post1+tuxcare of flask-cors.",
      "vulnerability": {
        "name": "CVE-2024-6866"
      }
    }
  ]
}