tocsin

Debian/python3.11: medium 6.1

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the gene

Action: Upgrade python3.11 to 3.11.2-6+deb12u9 or later.

Affected

introducedfixedlast affected
03.11.2-6+deb12u9-

Fixed versions

3.11.2-6+deb12u9

Sources

published · modified · JSON