oss-security - CVE request: XSS in python paste

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <i0dv67$n2g$1@dough.gmane.org>
Date: Tue, 29 Jun 2010 18:21:55 -0500
From: Raphael Geissert <geissert@...ian.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: XSS in python paste

Hi,

Quoting [1]:

> Paste 1.7.4 is released.  The only real change is to paste.httpexceptions, 
> which was using insecure quoting of some parameters and allowed an XSS 
> hole, 
> most specifically with its 404 messages.  The most notably WSGI 
> application 
> using this is paste.urlparse.StaticURLParser and PkgResourcesParser.  By 
> directing someone to an appropriately formed URL an attacker can execute 
> arbitrary Javascript on the victim's client.  paste.urlmap.URLMap is also 
> affected, but only if you have no application attached to /.  Other 
> applications using paste.httpexceptions may be effected (especially 
> HTTPNotFound).  WebOb/webob.exc.HTTPNotFound is not affected. 

The commit fixing this bug appears to be:
http://bitbucket.org/ianb/paste/changeset/fcae59df8b56
Homepage:
http://pythonpaste.org/

Could a CVE be assigned?

Thanks in advance.

[1] http://groups.google.com/group/paste-
users/browse_thread/thread/3b3fff3dadd0b1e5?pli=1

Regards,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.