CVE-2014-4650

Impact:
Moderate
Public Date:
2014-06-23
CWE:
CWE-138
Bugzilla:
1113527: CVE-2014-4650 python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs
It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose source of scripts in the cgi-bin directory.

Find out more about CVE-2014-4650 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This issue affects the versions of python as shipped with Red Hat Enterprise Linux 5 and 7 as well as Red Hat Software Collections. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

CVSS v2 metrics

Base Score 5
Base Metrics AV:N/AC:L/Au:N/C:P/I:N/A:N
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact None
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Software Collections for Red Hat Enterprise Linux 6 (python27-python) RHSA-2015:1064 2015-06-04
Red Hat Enterprise Linux 7 (python) RHSA-2015:2101 2015-11-19
Red Hat Software Collections for Red Hat Enterprise Linux 7 (python27-python) RHSA-2015:1064 2015-06-04
Red Hat Enterprise Linux 6 (python) RHSA-2015:1330 2015-07-20

Affected Packages State

Platform Package State
Red Hat Software Collections for Red Hat Enterprise Linux python33-python Will not fix
Red Hat Software Collections for Red Hat Enterprise Linux rh-python34-python Not affected
Red Hat Enterprise Linux 5 python Will not fix
Last Modified