Description
mod_python (libapache2-mod-python) 3.1.4 and earlier does not properly handle when output filters process more than 16384 bytes, which can cause filter.read to return portions of previously freed memory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache2-mod-python | 3.2.8-1 | — |
| Debian 12 | libapache2-mod-python | 3.2.8-1 | — |
References
- 24424 third-party-advisory
- USN-430-1 vendor-advisory
- [httpd-python-dev] 20040416 patch for filterobject.c mailing-list
- 20070307 rPSA-2007-0051-1 mod_python mailing-list
- [httpd-python-dev] 20040416 Re: possible bug in filter.write() mailing-list
- ADV-2007-0846 vdb-entry
- [httpd-python-dev] 20040416 possible bug in filter.write() mailing-list
- https://launchpad.net/bugs/89308
- http://svn.apache.org/viewvc/httpd/mod_python/trunk/src/filterobject.c?r1=102649&r2=103561&pathrev=103561
- https://issues.rpath.com/browse/RPL-1105
- 24418 third-party-advisory
- 22849 vdb-entry
- modpython-outputfilter-info-disclosure(14751) vdb-entry