Description
Unknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | libapache-mod-python | 2:2.7.8-0.0woody2 | DSA-452 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | mod_python | 3.0.3-3.ent | RHSA-2004:058 |
Advisories 2
- RHSA-2004:058 Red Hat Security Advisory: mod_python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-452 libapache-mod-python - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2004:058 vendor-advisory
- FEDORA-2004-1325 vendor-advisory
- oval:org.mitre.oval:def:839 vdb-entry signature
- http://www.modpython.org/pipermail/mod_python/2003-November/004005.html
- oval:org.mitre.oval:def:828 vdb-entry signature
- oval:org.mitre.oval:def:10259 vdb-entry signature
- CLA-2004:837 vendor-advisory
- DSA-452 vendor-advisory
- RHSA-2004:063 vendor-advisory