QID 981173

Security update has been released for invenio-app to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met:

1. Your webserver must have been configured to route all requests to your application.
2. You must have relied on ``APP_ALLOWED_HOSTS`` configuration variable to whitelist allowed host headers.
3. Flask's ``request.host`` must not have been evaluated during request handling.

An example of a view which does not evalute ``request.host`` is a simple view using just ``url_for`` to generate an external URL (similar is possible when rendering just a Jinja template):

```python
@app.route('/')
def index():
return url_for('index_url', _external=True)
```

This happens, because Werkzeug's trusted host feature, which ``APP_ALLOWED_HOSTS`` rely on, does not check the the list of trusted hosts in it's routing system that ``url_for`` is relying on.