CVE-2011-1015: Infoleak
An information disclosure flaw was found in the way Python CGI-savvy HTTP Server module processed HTTP GET requests with relative path in the URI (relevant CGI scripts were not executed, but rather their content displayed). A remote attacker could use this flaw to obtain sensitive information.
Upstream bug report: [1] http://bugs.python.org/issue2254
Related patch: [2] http://svn.python.org/view?view=revision&revision=71303
Other sources
The iscgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script source code via an HTTP GET request that lacks a / (slash) character at the beginning of the URI.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2011-1015.
What is the severity of CVE-2011-1015?
The severity of CVE-2011-1015 is medium.
How does CVE-2011-1015 affect Python?
CVE-2011-1015 affects Python version 2.5, 2.6, and 3.0.
How can remote attackers exploit CVE-2011-1015?
Remote attackers can exploit CVE-2011-1015 by sending an HTTP GET request without a slash character at the beginning of the URI, allowing them to read script source code.
Are there any references related to CVE-2011-1015?
Yes, there are references related to CVE-2011-1015. Please refer to the following links: - [http://openwall.com/lists/oss-security/2011/02/24/10](http://openwall.com/lists/oss-security/2011/02/24/10) - [http://www.securityfocus.com/bid/46541](http://www.securityfocus.com/bid/46541) - [http://hg.python.org/cpython/rev/c6c4398293bd/](http://hg.python.org/cpython/rev/c6c4398293bd/)