Date: Wed, 25 Jun 2014 20:24:23 -0400 (EDT) From: cve-assign@...re.org To: till.maas@...team-pentesting.de Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE ID Request for Python CGIHTTPServer File Disclosure -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > http://bugs.python.org/issue21766 Use CVE-2014-4650 for the "does not properly handle URL-encoded path separators in URLs" issue, with the two impacts of "gain access to the contents of CGI binaries or the source code of CGI scripts" and "execute code that was not intended to be executed." This CVE request was somewhat confusing in that it only mentioned file disclosure, but many CVE consumers would consider the code execution to be more important. If there is a complication -- for example, if the code execution CVE request was being handled separately -- please let us know. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTq2fSAAoJEKllVAevmvmsJ3wH/inxD0wVRzEdhXpu5Yr3kG8n WS4yvEjFKC+ev04Y6SM2K5JckJF3miA0VCURZ1075VRUiNESP2eseWEe6YGPC/OE OixE+pNfVv2Ex3HcHTkYyMRx5CJL1yCCOaeiYeqi2vIAa0fLbLbHqUiMSoSXPWfx IOMUF9IcMI3sovE3MQLQjhoiZnd4MErIhuEGRRdeg8P+F3mU+v67blwi7bfHqoH4 JcaLiOCjs8HQ0zbqrOTjh6ucVNIDwThlOJnhEJBCoajOLW4Y3RR5ev4TXLyRZzgQ FC76zDC1xwfsVxel5Ld4kLtEvI2weUDKf4R+kp88E6ORg2hTyywM3SFfAffx01g= =dclN -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ