CVE-2014-4650

NameCVE-2014-4650
DescriptionThe CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesELA-164-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)jessie, jessie (lts)2.7.9-2-ds1-1+deb8u12fixed
stretch (security)2.7.13-2+deb9u6fixed
stretch (lts), stretch2.7.13-2+deb9u9fixed
buster2.7.16-2+deb10u1fixed
buster (security)2.7.16-2+deb10u4fixed
bullseye2.7.18-8+deb11u1fixed
python3.4 (PTS)jessie, jessie (lts)3.4.2-1+deb8u17fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python2.6sourcewheezy(not affected)
python2.6source(unstable)(unfixed)low
python2.7sourcewheezy2.7.3-6+deb7u8ELA-164-1
python2.7source(unstable)2.7.8-1low
python3.1source(unstable)(unfixed)low
python3.2source(unstable)(unfixed)low
python3.3source(unstable)(unfixed)low
python3.4source(unstable)3.4.1-8low

Notes

[squeeze] - python2.6 <no-dsa> (Minor issue)
[wheezy] - python2.6 <no-dsa> (Minor issue)
[wheezy] - python2.7 <no-dsa> (Minor issue)
[squeeze] - python3.1 <no-dsa> (Minor issue)
[wheezy] - python3.2 <no-dsa> (Minor issue)
http://bugs.python.org/issue21766
[wheezy] - python2.6 <not-affected> (Vulnerable code not present)

Search for package or bug name: Reporting problems