Description
The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register_instance method to register an object without a _dispatch method, allows remote attackers to read or modify globals of the associated module, and possibly execute arbitrary code, via dotted attributes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | python2.2 | 2.2.1-4.7 | DSA-666-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | python +4 | 2.3.4-14.1 | RHSA-2005:108 |
| RHEL 3 | python +3 | 2.2.3-6.1 | RHSA-2005:109 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
Advisories 3
- RHSA-2005:109 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:108 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-666-1 python2.2 - design flaw Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1013083 vdb-entry
- python-simplexmlrpcserver-bypass(19217) vdb-entry
- http://www.python.org/security/PSF-2005-001/
- 20050203 Python Security Advisory PSF-2005-001 - SimpleXMLRPCServer.py mailing-list
- 2005-0003 vendor-advisory
- oval:org.mitre.oval:def:9811 vdb-entry signature
- 12437 vdb-entry
- 14128 third-party-advisory
- DSA-666 vendor-advisory
- http://python.org/security/PSF-2005-001/patch-2.2.txt
- MDKSA-2005:035 vendor-advisory
- RHSA-2005:108 vendor-advisory