Control: reassign -1 flask 3.1.1-1+deb13u1 Control: tags -1 trixie Control: affects -1 onionshare
Hey, this is an issue in flask/flask-socketio an not in onionshare itself. And was introduced by fixing CVE-2026-27205 within flask by backport: https://sources.debian.org/src/flask/3.1.1-1%2Bdeb13u1/debian/patches/ CVE-2026-27205-request-context-tracks-session-access.patch The problem is, that a commit from 3.1.3 got backported, that changes the API of flask, that is used by flask-socketio. With the fix for CVE-2026-27205 it would need to write to _session. flask-socketio has fixed that with 5.6.1. The relevant hunk is: https://github.com/miguelgrinberg/Flask-SocketIO/commit/ 956f8f2847c53d5156620b395912b7c916e15a1b#diff- d4032ca32e5dce64b1e46683f4bc8544ccefadb6e8f3e09a62152dda9c0a0578L815 This issue was reported two times already for unstable with flask-socketio < 5.6 and flask > 3.1.1: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132356 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136892 How we now do a follow-up? We actually need a pu for flask-socketio, or any other ideas? Regards, hefee -- On Mittwoch, 7. Oktober 2026 05:05 momfox67 wrote: > Package: onionshare-cli > Version: 2.6.3-1+deb13u2 > Severity: normal > > Dear Maintainer, > > running the following command: > > onionshare-cli --chat > > then connecting to the .onion link it outputs with the key it outputs, then > trying to type in the chat window gives the following error message and > fails to display the connection message or the typed chat message, > rendering the chat functionality completely unusable. share and receive > seem unaffected so far as i can discern - only chat is obviously broken > > Traceback (most recent call last): > File "/usr/lib/python3/dist-packages/engineio/server.py", line 450, in > run_handler return self.handlers[event](*args) > ~~~~~~~~~~~~~~~~~~~~^^^^^^^ > File "/usr/lib/python3/dist-packages/socketio/server.py", line 652, in > _handle_eio_message self._handle_connect(eio_sid, pkt.namespace, pkt.data) > ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > File "/usr/lib/python3/dist-packages/socketio/server.py", line 538, in > _handle_connect success = self._trigger_event( > 'connect', namespace, sid, self.environ[eio_sid]) > File "/usr/lib/python3/dist-packages/socketio/server.py", line 617, in > _trigger_event return handler(*args) > File "/usr/lib/python3/dist-packages/flask_socketio/__init__.py", line > 292, in _handler return self._handle_event(handler, message, real_ns, sid, > ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > *args) > ^^^^^^ > File "/usr/lib/python3/dist-packages/flask_socketio/__init__.py", line > 816, in _handle_event ctx.session = session_obj > ^^^^^^^^^^^ > AttributeError: property 'session' of 'RequestContext' object has no setter > > -- System Information: > Debian Release: 13.7 > APT prefers stable-updates > APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, > 'stable') Architecture: amd64 (x86_64) > > _______________________________________________ > Pkg-privacy-maintainers mailing list > [email protected] > https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-privacy-maintai > ners
signature.asc
Description: This is a digitally signed message part.
