—

PYSEC-2020-212

Quick fix

PYSEC-2020-212 — roundup: upgrade to the fixed version with the command below.

pip install --upgrade 'roundup>=1.4.20'

Details

Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/roundup

Introduced in: 0Fixed in: 1.4.20

Fixpip install --upgrade 'roundup>=1.4.20'

References

https://pypi.python.org/pypi/roundup/1.4.20[WEB]
http://www.openwall.com/lists/oss-security/2013/02/13/8[WEB]
http://www.openwall.com/lists/oss-security/2012/11/10/2[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=722672[REPORT]
http://issues.roundup-tracker.org/issue2550724[WEB]
https://github.com/advisories/GHSA-5jq3-8437-x35p[ADVISORY]