Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginni

Summary

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

Timeline

1. Aug 23, 2022, 12:00 AM UTCCVE published
2. Apr 17, 2024, 1:59 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 14, 2026, 11:39 AM UTCRecord last updated

Affected versions

• libpythonBitnami

  From 3.0.0 · fixed in 3.7.14; From 3.8.0 · fixed in 3.8.14; From 3.9.0 · fixed in 3.9.14; From 3.10.0 · fixed in 3.10.6

• pythonBitnami

  From 3.0.0 · fixed in 3.7.14; From 3.8.0 · fixed in 3.8.14; From 3.9.0 · fixed in 3.9.14; From 3.10.0 · fixed in 3.10.6

• python-minBitnami

  From 3.0.0 · fixed in 3.7.14; From 3.8.0 · fixed in 3.8.14; From 3.9.0 · fixed in 3.9.14; From 3.10.0 · fixed in 3.10.6

References 18