Paste 1.7.4 is released.  The only real change is to paste.httpexceptions,
which was using insecure quoting of some parameters and allowed an XSS hole,
most specifically with its 404 messages.  The most notably WSGI application
using this is paste.urlparse.StaticURLParser and PkgResourcesParser.  By
directing someone to an appropriately formed URL an attacker can execute
arbitrary Javascript on the victim's client.  paste.urlmap.URLMap is also
affected, but only if you have no application attached to /.  Other
applications using paste.httpexceptions may be effected (especially
HTTPNotFound).  WebOb/webob.exc.HTTPNotFound is not affected.

I believe the changes to 1.7.4 are limited and upgrading will have a low

This security hole was found by Tim Wintle <>
and I think entirely separately just a couple days later by Georg-Christian
Pranschke <>.

I'm sorry about this, I hope this won't cause you too much trouble.

Ian Bicking  |
Repoze-dev mailing list

Reply via email to