The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

Security update for python3

python: multiple unbound readline() DoS flaws in python stdlib python: XMLRPC library unrestricted decompression of HTTP responses using gzip enconding python: buffer overflow in socket.recvfrom_into() python: missing boundary check in JSON module python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs python: buffer() integer overflow leading to out of bounds read

Security update for python

Affected: Ubuntu:14.04:LTS: python2.7, Ubuntu:14.04:LTS: python3.4

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Python ausnutzen, um einen Denial of Service Angriff durchzuführen oder Code zur Ausführung zu bringen.