Lack of data validation - Path Traversal In python2
Description
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.10 | 2.7.16-r1 | ||
alpine v3.11 | 2.7.16-r1 | ||
alpine v3.9 | 2.7.16-r1 | ||
alpine v3.7 | 2.7.15-r2 | ||
alpine v3.8 | 2.7.15-r2 | ||
 debian 11 | 2.7.16-2 | ||
alpine v3.12 | 2.7.16-r1 | ||
 rpm rhel5 | - | - | |
rpm rhel7.5 | 0:2.7.5-74.el7_5 | ||
rpm rhel7.6 | 0:2.7.5-83.el7_6 |
1-10 of 14
10
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25.
References
1. 2. 3. 4. 5.