oss-security - Re: CVE Request -- Python (urllib, urllib2): Improper management of ftp:// and file:// URL schemes

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.64.1103281027270.7261@faron.mitre.org>
Date: Mon, 28 Mar 2011 10:27:49 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security <oss-security@...ts.openwall.com>
cc: "Steven M. Christey" <coley@...-smtp.mitre.org>,
        David Malcolm <dmalcolm@...hat.com>
Subject: Re: CVE Request -- Python (urllib, urllib2): Improper management of
 ftp:// and file:// URL schemes


On Thu, 24 Mar 2011, Jan Lieskovsky wrote:

>  A security flaw was found in the way handlers for ftp:// and
> file:// URL schemes in the Python urllib and urllib2 extensible
> libraries processed the urllib open URL request.
>
>...
>
> References:
> [1] http://bugs.python.org/issue11662
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=690560


Use CVE-2011-1521

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.