An information disclosure flaw was found in the way Python CGI-savvy HTTP Server module processed HTTP GET requests with relative path in the URI (relevant CGI scripts were not executed, but rather their content displayed). A remote attacker could use this flaw to obtain sensitive information. Upstream bug report: [1] http://bugs.python.org/issue2254 Related patch: [2] http://svn.python.org/view?view=revision&revision=71303
CVE Request: [3] http://www.openwall.com/lists/oss-security/2011/02/23/27
Created python tracking bugs for this issue Affects: fedora-13 [bug 680095]
This issue affects the versions of the python package, as shipped with Red Hat Enterprise Linux 4, 5, and 6. -- This issue affects the version of the python package, as shipped with Fedora release of 13. This issue does NOT affect the version of the python package, as shipped with Fedora release of 14 (particular version already contains the fix for this issue).
Note related to backporting of particular upstream patch: (from http://bugs.python.org/issue2254#msg85614): ================================================= Fixed in trunk r71303. This potentially changes the behavior of CGIHTTPServer (for the better) so this is probably not appropriate to backport to a release branch unless someone really considers the security of this to be severe. If backported, the new module function should be expanded inline to avoid adding a new (though undocumented) API. Closing.
This issue has been assigned the name CVE-2011-1015: http://www.openwall.com/lists/oss-security/2011/02/24/10
Regarding comment #4, this is only a demo class shipped with python, and we are fixing this, because there are other security issues to be fixed, so i dont see any issues even if the API changes slightly, @David, do you agree with this?
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2011:0492 https://rhn.redhat.com/errata/RHSA-2011-0492.html
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2011:0491 https://rhn.redhat.com/errata/RHSA-2011-0491.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0554 https://rhn.redhat.com/errata/RHSA-2011-0554.html