The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python2.7 | Jul 30, 2024 | Feb 20, 2020 |
| Oracle_linux | — | Upgrade python-libsUpgrade python-debugUpgrade python27-python-pipUpgrade python-develUpgrade python27-python-debugUpgrade python27-python-testUpgrade python27-python-setuptoolsUpgrade python27-python-wheelUpgrade python-testUpgrade python27-python-develUpgrade python27-python-libsUpgrade python27-runtimeUpgrade python27-pythonUpgrade python27-python-toolsUpgrade python27-python-simplejsonUpgrade python27-scldevelUpgrade tkinterUpgrade python27Upgrade pythonUpgrade python-toolsUpgrade python27-tkinter | Oct 16, 2024 | Feb 20, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 20, 2020 |
| Suse | — | Upgrade libpython3_4m1_0-32bitUpgrade libpython3_4m1_0Upgrade python3-idleUpgrade python-develUpgrade python39-toolsUpgrade libpython3_9-1_0Upgrade python39-develUpgrade libpython2_7-1_0-32bitUpgrade python-cursesUpgrade python39-tkUpgrade python-base-x86Upgrade python-idleUpgrade libpython2_6-1_0-32bitUpgrade python-demoUpgrade python3Upgrade libpython3_6m1_0-32bitUpgrade python3-baseUpgrade python3-32bitUpgrade python39-dbmUpgrade python-docUpgrade python3-develUpgrade python39-idleUpgrade python39Upgrade python3-testsuiteUpgrade pythonUpgrade python3-base-32bitUpgrade python-tkUpgrade python-xmlUpgrade python-base-32bitUpgrade python-gdbmUpgrade python36-baseUpgrade python36Upgrade libpython2_6-1_0Upgrade libpython3_6m1_0Upgrade python3-toolsUpgrade libpython2_6-1_0-x86Upgrade python-baseUpgrade python3-cursesUpgrade python39-baseUpgrade python39-cursesUpgrade libpython2_7-1_0Upgrade python3-dbmUpgrade python-32bitUpgrade python3-tkUpgrade python-doc-pdfUpgrade python-x86 | Dec 18, 2015 | Jun 25, 2015 |
| Ubuntu | — | Upgrade python3.4-minimalUpgrade python3.4Upgrade python3.2Upgrade python2.7Upgrade python2.7-minimalUpgrade python3.2-minimal | Nov 8, 2024 | Feb 20, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub