Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
07 Nov 2023, 03:32
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Summary | Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks." |
Information
Published : 2022-08-23 01:15
Updated : 2024-08-03 22:15
NVD link : CVE-2021-28861
Mitre link : CVE-2021-28861
CVE.ORG link : CVE-2021-28861
JSON object : View
Products Affected
fedoraproject
- fedora
python
- python
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')