CVE-2014-4650 The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct....
CriticalCVSS 9.8
EPSS 23.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/python2.7(Debian:11) | < 2.7.8-1 | 2.7.8-1 |
| python | >= 2.7.0, < 2.7.8 | 2.7.8 |
| python | >= 3.2.0, < 3.2.6 | 3.2.6 |
| python | >= 3.3.0, < 3.3.6 | 3.3.6 |
| python | >= 3.4.0, < 3.4.2 | 3.4.2 |
| redhat software collections | All versions | No fix listed |
| redhat enterprise linux | = 5.0 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- bugs.python.org exploit patch vendor-advisory
- openwall.com mailing-list third-party-advisory
- Red Hat third-party-advisory vendor-advisory