Paste 1.7.4 is released. The only real change is to paste.httpexceptions,
which was using insecure quoting of some parameters and allowed an XSS hole,
most specifically with its 404 messages. The most notably WSGI application
using this is paste.urlparse.StaticURLParser and PkgResourcesParser. By
directing someone to an appropriately formed URL an attacker can execute
affected, but only if you have no application attached to /. Other
applications using paste.httpexceptions may be effected (especially
HTTPNotFound). WebOb/webob.exc.HTTPNotFound is not affected.
I believe the changes to 1.7.4 are limited and upgrading will have a low
This security hole was found by Tim Wintle <http://www.rubberrepublic.com/>
and I think entirely separately just a couple days later by Georg-Christian
I'm sorry about this, I hope this won't cause you too much trouble.
Ian Bicking | http://blog.ianbicking.org
Repoze-dev mailing list