Description
The publisher handler for mod_python 2.7.8 and earlier allows remote attackers to obtain access to restricted objects via a crafted URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache2-mod-python | 3.1.3-3 | — |
| Debian 12 | libapache2-mod-python | 3.1.3-3 | — |
| Debian 3.0 | libapache-mod-python | 2:2.7.8-0.0woody5 | DSA-689-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | mod_python | 3.1.3-5.1 | RHSA-2005:100 |
| RHEL 3 | mod_python | 3.0.3-5.ent | RHSA-2005:104 |
Advisories 3
- RHSA-2005:104 Red Hat Security Advisory: mod_python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:100 Red Hat Security Advisory: mod_python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-689-1 libapache-mod-python - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2005:104 vendor-advisory
- GLSA-200502-14 vendor-advisory
- 2005-0003 vendor-advisory
- FLSA:152896 vendor-advisory
- 1013156 vdb-entry
- 20050211 [USN-80-1] mod_python vulnerability mailing-list
- CLA-2005:926 vendor-advisory
- 12519 vdb-entry
- DSA-689 vendor-advisory
- RHSA-2005:100 vendor-advisory
- VU#356409 third-party-advisory
- oval:org.mitre.oval:def:10617 vdb-entry signature