CVE-2012-5486
Fixed in a distro release EPSS 3%
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | plone | 4.2.3 |
| PyPI | plone | 4.3b1 |
| PyPI | zope2 | 2.13.19 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat rhel cluster 5 | conga | 0:0.12.2-81.el5 |
| Red Hat rhel cluster 5 | conga-debuginfo | 0:0.12.2-81.el5 |
| Red Hat rhel cluster 5 | luci | 0:0.12.2-81.el5 |
| Red Hat rhel cluster 5 | ricci | 0:0.12.2-81.el5 |