CVE-2011-1521

Published: May 24, 2011Modified: Apr 29, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs.

Affected (39)

Products: Python: Python

1 product

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Python Python	Version 2.0.1
Python Python	Version 2.0
Python Python	Version 2.1.1
Python Python	Version 2.1.2
Python Python	Version 2.1.3
Python Python	Version 2.1
Python Python	Version 2.2.1
Python Python	Version 2.2.2
Python Python	Version 2.2.3
Python Python	Version 2.2
Python Python	Version 2.3.1
Python Python	Version 2.3.2
Python Python	Version 2.3.3
Python Python	Version 2.3.4
Python Python	Version 2.3.5
Python Python	Version 2.3.7
Python Python	Version 2.4.1
Python Python	Version 2.4.2
Python Python	Version 2.4.3
Python Python	Version 2.4.4
Python Python	Version 2.4.6
Python Python	Version 2.5.1
Python Python	Version 2.5.2
Python Python	Version 2.5.3
Python Python	Version 2.5.4
Python Python	Version 2.6.1
Python Python	Version 2.6.4
Python Python	Version 2.6.5
Python Python	Version 2.6.6
Python Python	Version 2.6.7
Python Python	Version 2.7.1

Configuration B

8 vulnerable

Vulnerable Software	Affected Versions
Python Python	Version 3.0.1
Python Python	Version 3.0
Python Python	Version 3.1.1
Python Python	Version 3.1.2
Python Python	Version 3.1.3
Python Python	Version 3.1
Python Python	Version 3.2
Python Python	Version 3.2 alpha

Related CWEs

References (52)

http://bugs.python.org/issue11662

Source: cve@mitre.org

Patch

http://hg.python.org/cpython/file/96a6c128822b/Misc/NEWS

Source: cve@mitre.org

http://hg.python.org/cpython/file/b2934d98dac1/Misc/NEWS

Source: cve@mitre.org

http://hg.python.org/cpython/rev/96a6c128822b/

Source: cve@mitre.org

Patch

http://hg.python.org/cpython/rev/b2934d98dac1/

Source: cve@mitre.org

Patch

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2011/03/24/5

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2011/03/28/2

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2011/09/11/1

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2011/09/13/2

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2011/09/15/5

Source: cve@mitre.org

http://secunia.com/advisories/50858

Source: cve@mitre.org

http://secunia.com/advisories/51024

Source: cve@mitre.org

http://secunia.com/advisories/51040

Source: cve@mitre.org

http://securitytracker.com/id?1025488

Source: cve@mitre.org

http://support.apple.com/kb/HT5002

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2011:096

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-1592-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-1596-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-1613-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-1613-2

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=690560

Source: cve@mitre.org

Patch

https://bugzilla.redhat.com/show_bug.cgi?id=737366

Source: cve@mitre.org

https://www.djangoproject.com/weblog/2011/sep/09/

Source: cve@mitre.org

https://www.djangoproject.com/weblog/2011/sep/10/127/

Source: cve@mitre.org

http://bugs.python.org/issue11662

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://hg.python.org/cpython/file/96a6c128822b/Misc/NEWS

Source: af854a3a-2127-422b-91ae-364da2661108

http://hg.python.org/cpython/file/b2934d98dac1/Misc/NEWS

Source: af854a3a-2127-422b-91ae-364da2661108

http://hg.python.org/cpython/rev/96a6c128822b/

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://hg.python.org/cpython/rev/b2934d98dac1/

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/03/24/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/03/28/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/09/11/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/09/13/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/09/15/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/50858

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/51024

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/51040

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1025488

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT5002

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2011:096

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1592-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1596-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1613-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1613-2

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=690560

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://bugzilla.redhat.com/show_bug.cgi?id=737366

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.djangoproject.com/weblog/2011/sep/09/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.djangoproject.com/weblog/2011/sep/10/127/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.