The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
References
| Link | Resource |
|---|---|
| http://bugs.python.org/issue21766 | Exploit Patch Vendor Advisory |
| http://openwall.com/lists/oss-security/2014/06/26/3 | Mailing List Third Party Advisory |
| https://access.redhat.com/security/cve/cve-2014-4650 | Third Party Advisory |
| http://bugs.python.org/issue21766 | Exploit Patch Vendor Advisory |
| http://openwall.com/lists/oss-security/2014/06/26/3 | Mailing List Third Party Advisory |
| https://access.redhat.com/security/cve/cve-2014-4650 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 02:10
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://bugs.python.org/issue21766 - Exploit, Patch, Vendor Advisory | |
| References | () http://openwall.com/lists/oss-security/2014/06/26/3 - Mailing List, Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/cve-2014-4650 - Third Party Advisory |
Information
Published : 2020-02-20 17:15
Updated : 2024-11-21 02:10
NVD link : CVE-2014-4650
Mitre link : CVE-2014-4650
CVE.ORG link : CVE-2014-4650
JSON object : View
Products Affected
redhat
- software_collections
- enterprise_linux
python
- python
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')