Date: Wed, 14 Mar 2012 14:44:10 -0600 From: Vincent Danen <vdanen@...hat.com> To: oss-security@...ts.openwall.com Subject: Was a CVE ever assigned for Python SimpleHTTPServer.py XSS? I'm not sure if a CVE was ever assigned to this or not; it's an older issue that's fixed in 2.5.x and 2.6.x (I suspect 2.7.x is fixed too, but I cannot find a commit to be 100% sure). It sounds awfully familiar though. A flaw was reported in Python's SimpleHTTPServer's list_directory() function. Due to a missing charset parameter, if a user were to connect to SimpleHTTPServer using IE7, which engages in encoding-sniffing and can be tricked into interpretting the output as UTF7. Because of this, an attacker could hide <script> tags in UTF7-encoded characters which do not get quoted by cgi.encode(), allowing XSS attacks. This has been corrected upstream in version 2.6.7rc2 and 2.5.6c1. It may be fixed in 2.7 as well, but I was unable to find a commit to match it against. References: http://bugs.python.org/issue11442 http://svn.python.org/view/python/branches/release26-maint/Lib/SimpleHTTPServer.py?r1=66717&r2=88831&view=patch http://svn.python.org/view/python/branches/release25-maint/Lib/SimpleHTTPServer.py?r1=53148&r2=88815&view=patch https://bugzilla.redhat.com/show_bug.cgi?id=803500 -- Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.