{"action":"Upgrade roundup to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"}],"component":"roundup","cve_ids":["CVE-2019-10904"],"ecosystem":"PyPI","epss":0.01581,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-926q-wxr6-3crq","id":"tcs_01M5KG8Y2J4CP7HX2AGW7B5G5V","modified_at":"2023-11-08T04:00:58.523723Z","published_at":"2019-04-06T20:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-201","https://www.openwall.com/lists/oss-security/2019/04/05/1","https://github.com/python/bugs.python.org/issues/34","https://bugs.python.org/issue36391","http://www.openwall.com/lists/oss-security/2019/04/07/1","https://lists.debian.org/debian-lts-announce/2019/04/msg00009.html","https://github.com/advisories/GHSA-926q-wxr6-3crq"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-201","url":"https://osv.dev/vulnerability/PYSEC-2019-201"}],"summary":"Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors."}