[ubuntu/xenial-security] python2.7 2.7.12-1ubuntu0~16.04.1 (Accepted)

Steve Beattie sbeattie at ubuntu.com
Tue Nov 22 18:35:46 UTC 2016

python2.7 (2.7.12-1ubuntu0~16.04.1) xenial-security; urgency=medium

  * SECURITY UPDATE: use of HTTP_PROXY flag supplied by attacker in CGI
    scripts (aka HTTPOXY attack)
    - debian/patches/CVE-2016-1000110.patch: if running as CGI
      script, forget HTTP_PROXY in Lib/urllib.py, add test to
      Lib/test/test_urllib.py, add documentation.
    - CVE-2016-1000110
  * NOTE: backport of 2.7.12 to Ubuntu 16.04 LTS also addresses:
    - CVE-2016-0772: StartTLS stripping attack
    - CVE-2016-5636: Integer overflow when handling zipfiles

Date: 2016-11-19 08:11:13.230909+00:00
Changed-By: Steve Beattie <sbeattie at ubuntu.com>
-------------- next part --------------
Sorry, changesfile not available.

More information about the Xenial-changes mailing list