PyPI/roundup CVE-2019-10904: unknown, EPSS 1.58%

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.

Action: Upgrade roundup to 2.0.0 or later.

pip install roundup==2.0.0

Affected

Fixed versions

Sources

• osv: PYSEC-2019-201
• https://www.openwall.com/lists/oss-security/2019/04/05/1
• https://github.com/python/bugs.python.org/issues/34
• https://bugs.python.org/issue36391
• http://www.openwall.com/lists/oss-security/2019/04/07/1
• https://lists.debian.org/debian-lts-announce/2019/04/msg00009.html
• https://github.com/advisories/GHSA-926q-wxr6-3crq

CVE-2019-10904 · published 2019-04-06T20:29:00Z · modified 2023-11-08T04:00:58.523723Z · JSON