python / python/cpython

Multiple vulnerabilities in BaseHTTPRequestHandler enable HTTP response splitting attacks

Open
#73,610 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

3.7 (EOL) stdlib type-security
Dominant language
Python
Stars
77.2k
Forks
36k
PR merge metrics
PR metrics pending

Description

BPO 29424
Nosy @meitar
Files
  • python-3.6.0.patch: Proposed patch for Python 3.4+
  • python-2.7.13.patch: Proposed patch for Python 2.7+
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = None
    created_at = <Date 2017-02-02.21:33:01.182>
    labels = ['type-security', '3.7', 'library']
    title = 'Multiple vulnerabilities in BaseHTTPRequestHandler enable HTTP response splitting attacks'
    updated_at = <Date 2017-02-13.03:28:26.836>
    user = 'https://github.com/meitar'
    

    bugs.python.org fields:

    activity = <Date 2017-02-13.03:28:26.836>
    actor = 'bgilbert'
    assignee = 'none'
    closed = False
    closed_date = None
    closer = None
    components = ['Library (Lib)']
    creation = <Date 2017-02-02.21:33:01.182>
    creator = 'meitar'
    dependencies = []
    files = ['46497', '46498']
    hgrepos = []
    issue_num = 29424
    keywords = ['patch']
    message_count = 2.0
    messages = ['286828', '286829']
    nosy_count = 2.0
    nosy_names = ['bgilbert', 'meitar']
    pr_nums = []
    priority = 'normal'
    resolution = None
    stage = None
    status = 'open'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue29424'
    versions = ['Python 2.7', 'Python 3.4', 'Python 3.5', 'Python 3.6', 'Python 3.7']
    

    Contributor guide

    Open the contributing guide

    First steps

    1. Read the whole issue, then the project's contributing guide.
    2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
    3. Fork the repository and make your change on a branch.
    4. Open a pull request that references the issue number.

    Research direction

    Start with BaseHTTPRequestHandler and review the two proposed patch files, python-3.6.0.patch and python-2.7.13.patch. Compare their changes against the affected Python versions listed in the issue and verify that each reported response-splitting vulnerability is addressed consistently; the issue does not mention a test file or a specific repository entry point.

    Written by the indexing model from the issue text.

    Assessment

    Tech stack
    python
    Domain
    security
    Issue type
    Bug
    Difficulty
    4/5
    Estimated time
    3-5 days
    Activity status
    Stale
    Clarity
    Needs clarification
    Newbie friendliness
    25/100

    Get new issues in your inbox

    A short digest of beginner-friendly GitHub issues.