PYSEC-2019-201

2019-04-0620:29:00

Google

osv.dev

0.002 Low

EPSS

Percentile

53.7%

JSON

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.

CPENameOperatorVersion
roundupeq1.6.0
roundupeq1.3.3
roundupeq0.6.11
roundupeq1.4.19
roundupeq1.4.8
roundupeq0.8.2
roundupeq1.3.0
roundupeq0.8.5
roundupeq0.5.9
roundupeq2.0.0alpha0

Name	Operator	Version
roundup	eq	1.6.0
roundup	eq	1.3.3
roundup	eq	0.6.11
roundup	eq	1.4.19
roundup	eq	1.4.8
roundup	eq	0.8.2
roundup	eq	1.3.0
roundup	eq	0.8.5
roundup	eq	0.5.9
roundup	eq	2.0.0alpha0

Rows per page:

1-10 of 641

References

www.openwall.com/lists/oss-security/2019/04/07/1

bugs.python.org/issue36391

github.com/advisories/GHSA-926q-wxr6-3crq

github.com/python/bugs.python.org/issues/34

lists.debian.org/debian-lts-announce/2019/04/msg00009.html

www.openwall.com/lists/oss-security/2019/04/05/1

0.002 Low

EPSS

Percentile

53.7%

JSON

Related for OSV:PYSEC-2019-201