CVE-2011-1521

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://hg.python.org/cpython/file/96a6c128822b/Misc/NEWS", "name": "http://hg.python.org/cpython/file/96a6c128822b/Misc/NEWS", "tags": [], "refsource": "CONFIRM"}, {"url": "http://hg.python.org/cpython/file/b2934d98dac1/Misc/NEWS", "name": "http://hg.python.org/cpython/file/b2934d98dac1/Misc/NEWS", "tags": [], "refsource": "CONFIRM"}, {"url": "http://securitytracker.com/id?1025488", "name": "1025488", "tags": [], "refsource": "SECTRACK"}, {"url": "http://openwall.com/lists/oss-security/2011/03/28/2", "name": "[oss-security] 20110328 Re: CVE Request -- Python (urllib, urllib2): Improper management of ftp:// and file:// URL schemes", "tags": [], "refsource": "MLIST"}, {"url": "http://hg.python.org/cpython/rev/96a6c128822b/", "name": "http://hg.python.org/cpython/rev/96a6c128822b/", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=690560", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=690560", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://bugs.python.org/issue11662", "name": "http://bugs.python.org/issue11662", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://hg.python.org/cpython/rev/b2934d98dac1/", "name": "http://hg.python.org/cpython/rev/b2934d98dac1/", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://openwall.com/lists/oss-security/2011/03/24/5", "name": "[oss-security] 20110324 CVE Request -- Python (urllib, urllib2): Improper management of ftp:// and file:// URL schemes", "tags": [], "refsource": "MLIST"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:096", "name": "MDVSA-2011:096", "tags": [], "refsource": "MANDRIVA"}, {"url": "http://support.apple.com/kb/HT5002", "name": "http://support.apple.com/kb/HT5002", "tags": [], "refsource": "CONFIRM"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=737366", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=737366", "tags": [], "refsource": "CONFIRM"}, {"url": "https://www.djangoproject.com/weblog/2011/sep/10/127/", "name": "https://www.djangoproject.com/weblog/2011/sep/10/127/", "tags": [], "refsource": "CONFIRM"}, {"url": "http://openwall.com/lists/oss-security/2011/09/13/2", "name": "[oss-security] 20110913 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws", "tags": [], "refsource": "MLIST"}, {"url": "https://www.djangoproject.com/weblog/2011/sep/09/", "name": "https://www.djangoproject.com/weblog/2011/sep/09/", "tags": [], "refsource": "CONFIRM"}, {"url": "http://openwall.com/lists/oss-security/2011/09/11/1", "name": "[oss-security] 20110911 CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws", "tags": [], "refsource": "MLIST"}, {"url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html", "name": "APPLE-SA-2011-10-12-3", "tags": [], "refsource": "APPLE"}, {"url": "http://openwall.com/lists/oss-security/2011/09/15/5", "name": "[oss-security] 20110916 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws", "tags": [], "refsource": "MLIST"}, {"url": "http://www.ubuntu.com/usn/USN-1596-1", "name": "USN-1596-1", "tags": [], "refsource": "UBUNTU"}, {"url": "http://www.ubuntu.com/usn/USN-1613-2", "name": "USN-1613-2", "tags": [], "refsource": "UBUNTU"}, {"url": "http://www.ubuntu.com/usn/USN-1592-1", "name": "USN-1592-1", "tags": [], "refsource": "UBUNTU"}, {"url": "http://www.ubuntu.com/usn/USN-1613-1", "name": "USN-1613-1", "tags": [], "refsource": "UBUNTU"}, {"url": "http://secunia.com/advisories/51040", "name": "51040", "tags": [], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/50858", "name": "50858", "tags": [], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/51024", "name": "51024", "tags": [], "refsource": "SECUNIA"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html", "name": "SUSE-SR:2011:009", "tags": [], "refsource": "SUSE"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-399"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-1521", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2011-05-24T23:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:python:python:2.5.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.3.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.4.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.4.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.5.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.4.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.6.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.3.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.4.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.3.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.6.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.6.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.2.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.2.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.3.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.6.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.5.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.3.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:2.6.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:python:python:3.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:3.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:3.2:alpha:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:3.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:3.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:python:python:3.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2019-10-25T11:53Z"}