Detections
Analytics

RHEL 2.1 / 3 : mod_python (RHSA-2005:104)

high Nessus Plugin ID 16367

Synopsis

The remote Red Hat host is missing a security update.

Description

An Updated mod_python package that fixes a security issue in the publisher handler is now available.

Mod_python is a module that embeds the Python language interpreter within the Apache web server, allowing handlers to be written in Python.

Graham Dumpleton discovered a flaw affecting the publisher handler of mod_python, used to make objects inside modules callable via URL. A remote user could visit a carefully crafted URL that would gain access to objects that should not be visible, leading to an information leak.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0088 to this issue.

Users of mod_python are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

Solution

Update the affected mod_python package.

See Also

https://access.redhat.com/security/cve/cve-2005-0088

https://access.redhat.com/errata/RHSA-2005:104

Plugin Details

Severity: High

ID: 16367

File Name: redhat-RHSA-2005-104.nasl

Version: 1.26

Type: local

Agent: unix

Published: 2/10/2005

Updated: 1/14/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/o:redhat:enterprise_linux:2.1, cpe:/o:redhat:enterprise_linux:3, p-cpe:/a:redhat:enterprise_linux:mod_python

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 2/10/2005

Vulnerability Publication Date: 5/2/2005

Reference Information

CVE: CVE-2005-0088

RHSA: 2005:104