diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2014-09-16 22:23:55 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2014-09-16 22:23:55 (GMT) |
| commit | dad182c16e6c9d10267a659bd376ba3d10affd4f (patch) | |
| tree | c70767003a273334c2c4bc9d4773c2a087beb97a /Misc/NEWS | |
| parent | 860c367c29eb557930099a7cc7fe297a259275f6 (diff) | |
| download | cpython-dad182c16e6c9d10267a659bd376ba3d10affd4f.zip cpython-dad182c16e6c9d10267a659bd376ba3d10affd4f.tar.gz cpython-dad182c16e6c9d10267a659bd376ba3d10affd4f.tar.bz2 | |
Lax cookie parsing in http.cookies could be a security issue when combined
with non-standard cookie handling in some Web browsers.
Reported by Sergey Bobrov.
Diffstat (limited to 'Misc/NEWS')
| -rw-r--r-- | Misc/NEWS | 4 |
1 files changed, 4 insertions, 0 deletions
@@ -37,6 +37,10 @@ Library strings for ``rfc822Name`` (email), ``dNSName`` (DNS) and ``uniformResourceIdentifier`` (URI). +- Lax cookie parsing in http.cookies could be a security issue when combined + with non-standard cookie handling in some Web browsers. Reported by + Sergey Bobrov. + - Issue #21766: Prevent a security hole in CGIHTTPServer by URL unquoting paths before checking for a CGI script at that path. |