CVE-2015-7318

Advisory

Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.
https://plone.org/security/hotfix/20150910/header-injection

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.


MLIST:[oss-security] 20150922 Re: CVE Request: Plone header injection: http://www.openwall.com/lists/oss-security/2015/09/22/16
CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1264796: https://bugzilla.redhat.com/show_bug.cgi?id=1264796
CONFIRM:https://plone.org/security/hotfix/20150910: https://plone.org/security/hotfix/20150910
CONFIRM:https://plone.org/security/hotfix/20150910/header-injection: https://plone.org/security/hotfix/20150910/header-injection

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7318
• https://plone.org/security/hotfix/20150910/header-injection
• https://plone.org/security/hotfix/20150910
• https://bugzilla.redhat.com/show_bug.cgi?id=1264796
• http://www.openwall.com/lists/oss-security/2015/09/22/16