CVE-2011-1015
Published: 9 May 2011
The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script source code via an HTTP GET request that lacks a / (slash) character at the beginning of the URI.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
python2.4 Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
| hardy |
Released
(2.4.5-1ubuntu4.4)
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| precise |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
Patches: vendor: https://rhn.redhat.com/errata/RHSA-2011-0492.html |
||
|
python2.5 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Released
(2.5.2-2ubuntu6.2)
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| precise |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
python2.6 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Does not exist
|
|
| lucid |
Released
(2.6.5-1ubuntu6.1)
|
|
| maverick |
Ignored
(end of life)
|
|
| natty |
Released
(2.6.6-6ubuntu7.1)
|
|
| oneiric |
Released
(2.6.7-4ubuntu1.1)
|
|
| precise |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
Patches: vendor: https://rhn.redhat.com/errata/RHSA-2011-0554.html other: http://hg.python.org/cpython/rev/c6c4398293bd/ |
||
|
python2.7 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Does not exist
|
|
| lucid |
Does not exist
|
|
| maverick |
Not vulnerable
(2.7-6)
|
|
| natty |
Not vulnerable
|
|
| oneiric |
Not vulnerable
|
|
| precise |
Not vulnerable
|
|
| upstream |
Released
(2.7-1)
|
|