REDHAT-BUG-2460869: Medium severity Python http.cookies.Morsel vulnerability
http.cookies.Morsel.jsoutput() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2460869?
The severity of REDHAT-BUG-2460869 is classified as medium with a score of 4.
What vulnerability is discussed in REDHAT-BUG-2460869?
REDHAT-BUG-2460869 addresses an issue where the http.cookies.Morsel.js_output() function does not properly neutralize HTML parser-sensitive sequences.
How do I fix REDHAT-BUG-2460869?
To fix REDHAT-BUG-2460869, it is recommended to use mitigation techniques such as base64-encoding the cookie value.
What software is affected by REDHAT-BUG-2460869?
The vulnerability REDHAT-BUG-2460869 affects the Python http.cookies.Morsel module.
Is REDHAT-BUG-2460869 a critical vulnerability?
No, REDHAT-BUG-2460869 is not classified as critical, but it does pose a medium risk.