Multiple vulnerabilities in BaseHTTPRequestHandler enable HTTP response splitting attacks

未關閉

#73,610 建立於 2017年2月2日 2 則留言 0 個 reaction 已指派 0 人在 GitHub 檢視

還沒有人認領這個 Issue。

評估

難度: 4/5
預估耗時: 3-5 天
新手友好度: 25/100

Issue 類型: 缺陷
描述清晰度: 需要釐清
活躍度: 停滯
技術堆疊: python
領域: security

研究方向

從 BaseHTTPRequestHandler 開始，檢視提出的兩個修補檔案 python-3.6.0.patch 和 python-2.7.13.patch。將它們的變更與 issue 中列出的受影響 Python 版本進行比較，並驗證每個回報的 response splitting 漏洞是否都以一致的方式處理；該 issue 未提及測試檔案或特定的 repository 進入點。

由索引模型根據 Issue 內容生成。

描述

3.7 (EOL) stdlib type-security

BPO	29424
Nosy	@meitar
Files	python-3.6.0.patch: Proposed patch for Python 3.4+ python-2.7.13.patch: Proposed patch for Python 2.7+

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2017-02-02.21:33:01.182>
labels = ['type-security', '3.7', 'library']
title = 'Multiple vulnerabilities in BaseHTTPRequestHandler enable HTTP response splitting attacks'
updated_at = <Date 2017-02-13.03:28:26.836>
user = 'https://github.com/meitar'

bugs.python.org fields:

activity = <Date 2017-02-13.03:28:26.836>
actor = 'bgilbert'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2017-02-02.21:33:01.182>
creator = 'meitar'
dependencies = []
files = ['46497', '46498']
hgrepos = []
issue_num = 29424
keywords = ['patch']
message_count = 2.0
messages = ['286828', '286829']
nosy_count = 2.0
nosy_names = ['bgilbert', 'meitar']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue29424'
versions = ['Python 2.7', 'Python 3.4', 'Python 3.5', 'Python 3.6', 'Python 3.7']

主要語言: Python
星號: 77.2k
分支: 36k
平均合併: 1 天 9 小時
30 天內合併 PR: 558