PyPI/roundup CVE-2014-6276: unknown, EPSS 1.55%
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing
Action: Upgrade roundup to 1.5.1 or later.
pip install roundup==1.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.1 | - |
Fixed versions
| 1.5.1 |
Sources
- osv: PYSEC-2016-33
- http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9
- https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt
- http://www.debian.org/security/2016/dsa-3502
- https://github.com/advisories/GHSA-j556-q367-2gw6
CVE-2014-6276 · published · modified · JSON