Description
The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | python2.7 | 2.7.2-8 | — |
| Debian 6.0 | python2.6 | 2.6.6-8+deb6u1 | DLA-25-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | python +5 | 2.6.6-29.el6_2.2 | RHSA-2012:0744 |
| RHEL 5 | python +4 | 2.4.3-46.el5_8.2 | RHSA-2012:0745 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
Advisories 3
- RHSA-2012:0744 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0745 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DLA-25-1 python2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-1592-1 vendor-advisory
- JVN#51176027 third-party-advisory
- 51040 third-party-advisory
- 50858 third-party-advisory
- http://bugs.python.org/issue11442
- 54083 vdb-entry
- USN-1596-1 vendor-advisory
- USN-1613-2 vendor-advisory
- JVNDB-2012-000063 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=803500
- 51024 third-party-advisory
- USN-1613-1 vendor-advisory