—

PYSEC-2014-16

Quick fix

PYSEC-2014-16 — roundup: upgrade to the fixed version with the command below.

pip install --upgrade 'roundup>=1.4.20'

Details

Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/roundup

Introduced in: 0Fixed in: 1.4.20

Fixpip install --upgrade 'roundup>=1.4.20'

References

http://www.openwall.com/lists/oss-security/2013/02/13/8[WEB]
http://issues.roundup-tracker.org/issue2550711[WEB]
http://www.openwall.com/lists/oss-security/2012/11/10/2[WEB]
https://pypi.python.org/pypi/roundup/1.4.20[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=722672[REPORT]
https://exchange.xforce.ibmcloud.com/vulnerabilities/84190[WEB]
https://github.com/advisories/GHSA-gw2q-cgvq-9g3v[ADVISORY]