[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201406260024.s5Q0ONr5001579@linus.mitre.org>
Date: Wed, 25 Jun 2014 20:24:23 -0400 (EDT)
From: cve-assign@...re.org
To: till.maas@...team-pentesting.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE ID Request for Python CGIHTTPServer File Disclosure
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> http://bugs.python.org/issue21766
Use CVE-2014-4650 for the "does not properly handle URL-encoded path
separators in URLs" issue, with the two impacts of "gain access to the
contents of CGI binaries or the source code of CGI scripts" and
"execute code that was not intended to be executed."
This CVE request was somewhat confusing in that it only mentioned
file disclosure, but many CVE consumers would consider the
code execution to be more important. If there is a complication --
for example, if the code execution CVE request was being handled
separately -- please let us know.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTq2fSAAoJEKllVAevmvmsJ3wH/inxD0wVRzEdhXpu5Yr3kG8n
WS4yvEjFKC+ev04Y6SM2K5JckJF3miA0VCURZ1075VRUiNESP2eseWEe6YGPC/OE
OixE+pNfVv2Ex3HcHTkYyMRx5CJL1yCCOaeiYeqi2vIAa0fLbLbHqUiMSoSXPWfx
IOMUF9IcMI3sovE3MQLQjhoiZnd4MErIhuEGRRdeg8P+F3mU+v67blwi7bfHqoH4
JcaLiOCjs8HQ0zbqrOTjh6ucVNIDwThlOJnhEJBCoajOLW4Y3RR5ev4TXLyRZzgQ
FC76zDC1xwfsVxel5Ld4kLtEvI2weUDKf4R+kp88E6ORg2hTyywM3SFfAffx01g=
=dclN
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
