CVE-2014-4650

NameCVE-2014-4650
DescriptionThe CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)stretch2.7.13-2+deb9u3fixed
stretch (security)2.7.13-2+deb9u4fixed
buster2.7.16-2+deb10u1fixed
bullseye2.7.18-1fixed
sid2.7.18-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python2.6source(unstable)(unfixed)low
python2.7source(unstable)2.7.8-1low
python3.1source(unstable)(unfixed)low
python3.2source(unstable)(unfixed)low
python3.3source(unstable)(unfixed)low
python3.4source(unstable)3.4.1-8low

Notes

[squeeze] - python2.6 <no-dsa> (Minor issue)
[wheezy] - python2.6 <no-dsa> (Minor issue)
[wheezy] - python2.7 <no-dsa> (Minor issue)
[squeeze] - python3.1 <no-dsa> (Minor issue)
[wheezy] - python3.2 <no-dsa> (Minor issue)
http://bugs.python.org/issue21766

Search for package or bug name: Reporting problems