BIT-python-2021-28861
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2021-28861.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-python-2021-28861
- Aliases
- Published
- 2024-03-06T11:06:51.991Z
- Modified
- 2024-03-06T11:25:28.861Z
- Summary
- [none]
- Details
-
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
- References
-
- https://bugs.python.org/issue43223
- https://github.com/python/cpython/pull/24848
- https://github.com/python/cpython/pull/93879
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2TRINJE3INWDVIHIABW4L2NP3RUSK7BJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LTSPFIULY2GZJN3QYNFVM4JSU6H4D6J/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OABQ5CMPQETJLFHROAXDIDXCMDTNVYG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DISZAFSIQ7IAPAEQTC7G2Z5QUA2V2PSW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPX4XHT2FGVQYLY2STT2MRVENILNZTTU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I3MQT5ZE3QH5PVDJMERTBOCILHK35CBE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRGKPYA5YHIXQAMRIXO5DSCX7D4UUW4Q/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLE5INSVJUZJGY5OJXV6JREXWD7UDHYN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G66SRWUM36ENQ3X6LAIG7HAB27D4XJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZEPOPUFC42KXXSLFPZ47ZZRGPOR7SQE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X46T4EFTIBXZRYTGASBDEZGYJINH2OWV/
- https://security.gentoo.org/glsa/202305-02
Affected packages
Bitnami / python
Package
- Name
- python
- Purl
- pkg:bitnami/python
Severity
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
Affected ranges
- Type
- SEMVER
- Events
-
Introduced3.0.0Fixed3.7.14Introduced3.8.0Fixed3.8.14Introduced3.9.0Fixed3.9.14Introduced3.10.0Fixed3.10.6
- Type
- SEMVER
- Events
-
Introduced3.11.0-alpha1Last affected3.11.0-alpha1Introduced3.11.0-alpha2Last affected3.11.0-alpha2Introduced3.11.0-alpha3Last affected3.11.0-alpha3Introduced3.11.0-alpha4Last affected3.11.0-alpha4Introduced3.11.0-alpha5Last affected3.11.0-alpha5Introduced3.11.0-alpha6Last affected3.11.0-alpha6Introduced3.11.0-alpha7Last affected3.11.0-alpha7Introduced3.11.0-beta1Last affected3.11.0-beta1Introduced3.11.0-beta2Last affected3.11.0-beta2Introduced3.11.0-beta3Last affected3.11.0-beta3