CVE-2014-4650

Advisory

Python versions 2.7.8, 3.2.6, 3.3.6 and 3.4.2 include a fix for CVE-2014-4650: The CGIHTTPServer module in Python 2.7.5 and 3.3.4 (possible in others too) does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
https://bugs.python.org/issue21766

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4650
• http://bugs.python.org/issue21766
• http://openwall.com/lists/oss-security/2014/06/26/3
• https://access.redhat.com/security/cve/cve-2014-4650