PT-2012-2008 · Python+3 · Python+3

Vincent Danen · Published 2012-06-18 · Updated 2023-02-13 · CVE-2011-4940

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Python versions prior to 2.5.6c1 Python versions 2.6.x prior to 2.6.7 rc2 Python versions 2.7.x prior to 2.7.2

Description The issue concerns the list directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer, which does not include a charset parameter in the Content-Type HTTP header. This omission makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks, particularly against Internet Explorer 7, by utilizing UTF-7 encoding.

Recommendations For Python versions prior to 2.5.6c1, update to version 2.5.6c1 or later. For Python versions 2.6.x prior to 2.6.7 rc2, update to version 2.6.7 rc2 or later. For Python versions 2.7.x prior to 2.7.2, update to version 2.7.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CESA-2012_0744

CVE-2011-4940

DLA-25-1

PSF-2012-1

RHSA-2012:0744

RHSA-2012:0745

RHSA-2012_0744

RHSA-2012_0745

Affected Products

Centos

Internet Explorer

Python

Red Hat

References · 37

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0845 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-4940 · Vendor Advisory
• http://ubuntu.com/usn/USN-1613-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4940 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4944 · Security Note
• https://osv.dev/vulnerability/CVE-2011-4940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4940 · Security Note
• http://ubuntu.com/usn/USN-1596-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-1613-2 · Vendor Advisory
• http://ubuntu.com/usn/USN-1592-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4940 · Security Note
• https://linux.oracle.com/errata/ELSA-2012-0744.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1150 · Security Note
• https://osv.dev/vulnerability/PSF-2012-1 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4940 · Note