—

PYSEC-2014-15

Quick fix

PYSEC-2014-15 — roundup: upgrade to the fixed version with the command below.

pip install --upgrade 'roundup>=1.4.20'

Details

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/roundup

Introduced in: 0Fixed in: 1.4.20

Fixpip install --upgrade 'roundup>=1.4.20'

References

http://issues.roundup-tracker.org/issue2550684[WEB]
https://pypi.python.org/pypi/roundup/1.4.20[WEB]
http://www.openwall.com/lists/oss-security/2012/11/10/2[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=722672[REPORT]
http://www.openwall.com/lists/oss-security/2013/02/13/8[WEB]
https://exchange.xforce.ibmcloud.com/vulnerabilities/84189[WEB]
https://github.com/advisories/GHSA-mccq-3m7h-fjxg[ADVISORY]