[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 01 May 2014 14:33:02 +1000
From: Murray McAllister <mmcallis@...hat.com>
To: oss-security@...ts.openwall.com
CC: 746322@...s.debian.org
Subject: CVE request: Python Bottle JSON content-type not restrictive enough
Hi,
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746322 and
https://github.com/defnull/bottle/issues/616 report an issue where
Bottle treated "text/plain;application/json" as JSON, allowing security
mechanisms to be bypassed.
From the upstream report, "For example Chrome will not allow
cross-origin xmlhttprequests with the content type set to
"application/json" but you can set it to "text/plain;application/json"
instead and bottle will accept it."
Can a CVE please be assigned if one has not been already?
Thanks,
--
Murray McAllister / Red Hat Security Response Team
https://bugzilla.redhat.com/show_bug.cgi?id=1093255
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
