Control: reassign -1 flask-socketio 5.5.1 Control: affects -1 src:onionshare Control: merge 1132356 1136892 -1 Control: tags -1 patch
Hey, The patch to fix CVE-2026-27205 changed API of Flask. So flask-socketio cannot be used within onionshare :( The detailed analysis you find at my former response. I prepared a proposed-update for Trixie, the debdiff is attached or you can look at the created merge request: https://salsa.debian.org/debian/python-flask-socketio/-/merge_requests/3 Regards, hefee -- On Dienstag, 13. Oktober 2026 16:30 Hefee wrote: > Control: reassign -1 flask 3.1.1-1+deb13u1 > Control: tags -1 trixie > Control: affects -1 onionshare > > Hey, > > this is an issue in flask/flask-socketio an not in onionshare itself. > > And was introduced by fixing CVE-2026-27205 within flask by backport: > https://sources.debian.org/src/flask/3.1.1-1%2Bdeb13u1/debian/patches/ > CVE-2026-27205-request-context-tracks-session-access.patch > > The problem is, that a commit from 3.1.3 got backported, that changes the > API of flask, that is used by flask-socketio. With the fix for > CVE-2026-27205 it would need to write to _session. flask-socketio has fixed > that with 5.6.1. The relevant hunk is: > https://github.com/miguelgrinberg/Flask-SocketIO/commit/ > 956f8f2847c53d5156620b395912b7c916e15a1b#diff- > d4032ca32e5dce64b1e46683f4bc8544ccefadb6e8f3e09a62152dda9c0a0578L815 > > This issue was reported two times already for unstable with > flask-socketio < 5.6 and flask > 3.1.1: > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132356 > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136892 > > How we now do a follow-up? We actually need a pu for flask-socketio, or any > other ideas? > > Regards, > > hefee > > -- > > On Mittwoch, 7. Oktober 2026 05:05 momfox67 wrote: > > Package: onionshare-cli > > Version: 2.6.3-1+deb13u2 > > Severity: normal > > > > Dear Maintainer, > > > > running the following command: > > > > onionshare-cli --chat > > > > then connecting to the .onion link it outputs with the key it outputs, > > then > > trying to type in the chat window gives the following error message and > > fails to display the connection message or the typed chat message, > > rendering the chat functionality completely unusable. share and receive > > seem unaffected so far as i can discern - only chat is obviously broken > > > > Traceback (most recent call last): > > File "/usr/lib/python3/dist-packages/engineio/server.py", line 450, in > > > > run_handler return self.handlers[event](*args) > > > > ~~~~~~~~~~~~~~~~~~~~^^^^^^^ > > > > File "/usr/lib/python3/dist-packages/socketio/server.py", line 652, in > > > > _handle_eio_message self._handle_connect(eio_sid, pkt.namespace, pkt.data) > > > > ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > > > File "/usr/lib/python3/dist-packages/socketio/server.py", line 538, in > > > > _handle_connect success = self._trigger_event( > > > > 'connect', namespace, sid, self.environ[eio_sid]) > > > > File "/usr/lib/python3/dist-packages/socketio/server.py", line 617, in > > > > _trigger_event return handler(*args) > > > > File "/usr/lib/python3/dist-packages/flask_socketio/__init__.py", line > > > > 292, in _handler return self._handle_event(handler, message, real_ns, sid, > > > > ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > > > *args) > > ^^^^^^ > > > > File "/usr/lib/python3/dist-packages/flask_socketio/__init__.py", line > > > > 816, in _handle_event ctx.session = session_obj > > > > ^^^^^^^^^^^ > > > > AttributeError: property 'session' of 'RequestContext' object has no > > setter > > > > -- System Information: > > Debian Release: 13.7 > > > > APT prefers stable-updates > > APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, > > > > 'stable') Architecture: amd64 (x86_64)
diff -Nru flask-socketio-5.5.1/debian/changelog flask-socketio-5.5.1/debian/changelog --- flask-socketio-5.5.1/debian/changelog 2025-03-12 17:06:11.000000000 +0100 +++ flask-socketio-5.5.1/debian/changelog 2026-10-19 20:25:10.000000000 +0200 @@ -1,3 +1,11 @@ +flask-socketio (5.5.1-1+deb13u1) UNRELEASED; urgency=medium + + * gbp.conf debian-branch to debian/trixie. + * Fix breakage introduced by CVE-2026-27205 (Closes: #1150205) + - Add upstream patch that use the updated Flask API. + + -- Sandro Knauß <[email protected]> Mon, 19 Oct 2026 20:25:10 +0200 + flask-socketio (5.5.1-1) unstable; urgency=medium * New upstream version 5.5.1. diff -Nru flask-socketio-5.5.1/debian/gbp.conf flask-socketio-5.5.1/debian/gbp.conf --- flask-socketio-5.5.1/debian/gbp.conf 2025-03-12 17:05:40.000000000 +0100 +++ flask-socketio-5.5.1/debian/gbp.conf 2026-10-19 19:59:57.000000000 +0200 @@ -1,4 +1,4 @@ [DEFAULT] -debian-branch = debian/master +debian-branch = debian/trixie upstream-branch = upstream pristine-tar = True diff -Nru flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch --- flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch 1970-01-01 01:00:00.000000000 +0100 +++ flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch 2026-10-19 20:22:45.000000000 +0200 @@ -0,0 +1,36 @@ +From: =?utf-8?q?Sandro_Knau=C3=9F?= <[email protected]> +Date: Mon, 19 Oct 2026 19:55:37 +0200 +Subject: Fix breakage introduced by CVE-2026-27205 + +The patch to fix CVE-2026-27205 changed API of Flask. This patch +updates the API usage to get flask-socketio working again. + +cherry-picked only a hunk of 956f8f2847c53d5156620b395912b7c916e15a1b + +Author: Miguel Grinberg <[email protected]> +Origin: upstream, https://github.com/miguelgrinberg/Flask-SocketIO/commit/956f8f2847c53d5156620b395912b7c916e15a1b +Debian-Bug: https://bugs.debian.org/1150205 +Forwarded: not-needed +--- + src/flask_socketio/__init__.py | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/src/flask_socketio/__init__.py b/src/flask_socketio/__init__.py +index 219f30c..8e2cc8f 100644 +--- a/src/flask_socketio/__init__.py ++++ b/src/flask_socketio/__init__.py +@@ -813,7 +813,13 @@ class SocketIO: + else: # pragma: no cover + # update session for Flask < 2.2 + ctx = flask._request_ctx_stack.top +- ctx.session = session_obj ++ if hasattr(ctx, '_session'): ++ # update session for Flask >= 3.1.3 ++ # and Debian backported version (fixed CVE-2026-27205) ++ ctx._session = session_obj ++ else: ++ # update session for Flask < 3.1.3 ++ ctx.session = session_obj + else: + # let Flask handle the user session + # for cookie based sessions, this effectively freezes the diff -Nru flask-socketio-5.5.1/debian/patches/series flask-socketio-5.5.1/debian/patches/series --- flask-socketio-5.5.1/debian/patches/series 1970-01-01 01:00:00.000000000 +0100 +++ flask-socketio-5.5.1/debian/patches/series 2026-10-19 20:22:45.000000000 +0200 @@ -0,0 +1 @@ +0001-Fix-breakage-introduced-by-CVE-2026-27205.patch
signature.asc
Description: This is a digitally signed message part.
