—

PYSEC-2010-1

Quick fix

PYSEC-2010-1 — mako: upgrade to the fixed version with the command below.

pip install --upgrade 'mako>=0.3.4'

Details

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/mako

Introduced in: 0Fixed in: 0.3.4

Fixpip install --upgrade 'mako>=0.3.4'

References

http://bugs.python.org/issue9061[WEB]
http://secunia.com/advisories/39935[ADVISORY]
http://www.makotemplates.org/CHANGES[WEB]
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html[WEB]
https://github.com/advisories/GHSA-7q8x-38mc-p84f[ADVISORY]