CVE-2014-4650
Fixed in a distro release EPSS 24%
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Products: python, redhat software_collections, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | python2.7 | 2.7.8-1 |
| Red Hat Enterprise Linux 6 | python | 0:2.6.6-64.el6 |
| Red Hat Enterprise Linux 6 | python-debuginfo | 0:2.6.6-64.el6 |
| Red Hat Enterprise Linux 6 | python-devel | 0:2.6.6-64.el6 |
| Red Hat Enterprise Linux 6 | python-libs | 0:2.6.6-64.el6 |
| Red Hat Enterprise Linux 6 | python-test | 0:2.6.6-64.el6 |
| Red Hat Enterprise Linux 6 | python-tools | 0:2.6.6-64.el6 |
| Red Hat Enterprise Linux 6 | tkinter | 0:2.6.6-64.el6 |
| Red Hat Enterprise Linux 7 | python | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-debug | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-debuginfo | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-devel | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-libs | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-test | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-tools | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | tkinter | 0:2.7.5-34.el7 |
| Red Hat rhel software collections 2 | python27 | 0:1.1-20.el7 |
| Red Hat rhel software collections 2 | python27 | 0:1.1-17.el6 |
| Red Hat rhel software collections 2 | python27-python | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-debug | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-debug | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-debuginfo | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-debuginfo | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-devel | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-devel | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-libs | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-libs | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-pip | 0:1.5.6-5.el7 |
| Red Hat rhel software collections 2 | python27-python-pip | 0:1.5.6-5.el6 |
| Red Hat rhel software collections 2 | python27-python-setuptools | 0:0.9.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-setuptools | 0:0.9.8-5.el7 |
| Red Hat rhel software collections 2 | python27-python-simplejson | 0:3.2.0-2.el6 |
| Red Hat rhel software collections 2 | python27-python-simplejson | 0:3.2.0-3.el7 |
| Red Hat rhel software collections 2 | python27-python-simplejson-debuginfo | 0:3.2.0-2.el6 |
| Red Hat rhel software collections 2 | python27-python-simplejson-debuginfo | 0:3.2.0-3.el7 |
| Red Hat rhel software collections 2 | python27-python-test | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-test | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-tools | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-tools | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-wheel | 0:0.24.0-2.el7 |
| Red Hat rhel software collections 2 | python27-python-wheel | 0:0.24.0-2.el6 |
| Red Hat rhel software collections 2 | python27-runtime | 0:1.1-17.el6 |
| Red Hat rhel software collections 2 | python27-runtime | 0:1.1-20.el7 |
| Red Hat rhel software collections 2 | python27-scldevel | 0:1.1-20.el7 |
| Red Hat rhel software collections 2 | python27-scldevel | 0:1.1-17.el6 |
| Red Hat rhel software collections 2 | python27-tkinter | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-tkinter | 0:2.7.8-3.el6 |
| SUSE Linux Enterprise Desktop 12 | python | 2.7.9-14.1 |
| SUSE Linux Enterprise Desktop 12 | python-base | 2.7.9-14.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | python | 2.7.17-7.32.2 |
| SUSE Linux Enterprise Module for Basesystem 15 | python-base | 2.7.17-7.32.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | python3 | 3.6.10-3.42.2 |
| SUSE Linux Enterprise Module for Basesystem 15 | python3-base | 3.6.10-3.42.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | python | 2.7.17-7.32.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | python-base | 2.7.17-7.32.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | python3 | 3.6.10-3.42.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | python3-base | 3.6.10-3.42.2 |
| SUSE Linux Enterprise Module for Desktop Applications 15 | python | 2.7.17-7.32.2 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP1 | python | 2.7.17-7.32.2 |
| SUSE Linux Enterprise Module for Development Tools 15 | python3-base | 3.6.10-3.42.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP1 | python3-base | 3.6.10-3.42.2 |
| SUSE Linux Enterprise Module for Python 2 15 SP1 | python | 2.7.17-7.32.2 |
| SUSE Linux Enterprise Module for Python 2 15 SP1 | python-base | 2.7.17-7.32.1 |
| SUSE Linux Enterprise Server 12 | python | 2.7.9-14.1 |
| SUSE Linux Enterprise Server 12 | python-base | 2.7.9-14.1 |
| SUSE Linux Enterprise Server 12 | python-doc | 2.7.9-14.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 | python | 2.7.9-14.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | python-base | 2.7.9-14.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | python-doc | 2.7.9-14.3 |
| SUSE Linux Enterprise Software Development Kit 12 | python-base | 2.7.9-14.1 |
| SUSE Linux Enterprise Workstation Extension 12 | python-base | 2.7.9-14.1 |
| Ubuntu 14.04 LTS | python2.7 | 2.7.6-8ubuntu0.2 |
| Ubuntu 14.04 LTS | python3.4 | 3.4.0-2ubuntu1.1 |
| openSUSE Leap 15.1 | python3 | 3.6.10-lp151.6.7.1 |
| openSUSE Leap 15.1 | python3-base | 3.6.10-lp151.6.7.1 |
| openSUSE Tumbleweed | python | 2.7.18-8.1 |
| openSUSE Tumbleweed | python-base | 2.7.12-1.4 |
| openSUSE Tumbleweed | python3 | 3.5.1-3.8 |
| openSUSE Tumbleweed | python310 | 3.10.0rc1-4.2 |
| openSUSE Tumbleweed | python311 | 3.11.0b1-1.1 |
| openSUSE Tumbleweed | python312 | 3.12.0a7-1.1 |
| openSUSE Tumbleweed | python313 | 3.13.0~b3-1.1 |
| openSUSE Tumbleweed | python314 | 3.14.0~a1-1.1 |
| openSUSE Tumbleweed | python315 | 3.15.0~a1-1.1 |
| openSUSE Tumbleweed | python36 | 3.6.15-1.1 |
| openSUSE Tumbleweed | python38 | 3.8.12-1.2 |
| openSUSE Tumbleweed | python39 | 3.9.7-2.1 |