High · published August 23, 2022
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
| Product | Versions | Fixed in |
|---|---|---|
| python/python | ≥ 3.0.0, < 3.7.14 | 3.7.14 |
| python/python | ≥ 3.8.0, < 3.8.14 | 3.8.14 |
| python/python | ≥ 3.9.0, < 3.9.14 | 3.9.14 |
| python/python | ≥ 3.10.0, < 3.10.6 | 3.10.6 |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |