Read the docs
TI-2014-03832 Aliases CVE-2014-4650GHSA-33c8-ggqv-8g5p

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which…

Priority MEDIUM 63CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 22 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

Why it matters now

EPSS 0.23907 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 3 advisoriesRed Hat: 22 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*2.7.0 to before 2.7.8; 3.2.0 to before 3.2.6; 3.3.0 to before 3.3.6; 3.4.0 to before 3.4.2Vulnerablepython-pillow
cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.8; 3.2.0 to before 3.2.6; 3.3.0 to before 3.3.6; 3.4.0 to before 3.4.2 Vulnerable ·python-pillow
  • cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2015:2101 Released 2015-11-19 · Red Hat rating Moderate
    python security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Client (v. 7) python-2.7.5-34.el7, python-libs-2.7.5-34.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) python-debug-2.7.5-34.el7, python-devel-2.7.5-34.el7, python-test-2.7.5-34.el7 +2
    • Red Hat Enterprise Linux ComputeNode (v. 7) python-2.7.5-34.el7, python-devel-2.7.5-34.el7, python-libs-2.7.5-34.el7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-debug-2.7.5-34.el7, python-test-2.7.5-34.el7, python-tools-2.7.5-34.el7 +1
    • Red Hat Enterprise Linux Server (v. 7) python-2.7.5-34.el7, python-devel-2.7.5-34.el7, python-libs-2.7.5-34.el7 +1
    • Red Hat Enterprise Linux Server Optional (v. 7) python-debug-2.7.5-34.el7, python-test-2.7.5-34.el7, python-tools-2.7.5-34.el7 +1
    • Red Hat Enterprise Linux Workstation (v. 7) python-2.7.5-34.el7, python-devel-2.7.5-34.el7, python-libs-2.7.5-34.el7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) python-debug-2.7.5-34.el7, python-test-2.7.5-34.el7, python-tools-2.7.5-34.el7 +1
  • RHSA-2015:1330 Released 2015-07-20 · Red Hat rating Moderate
    python security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Desktop (v. 6) python-2.6.6-64.el6, python-libs-2.6.6-64.el6, tkinter-2.6.6-64.el6
    • Red Hat Enterprise Linux Desktop Optional (v. 6) python-devel-2.6.6-64.el6, python-test-2.6.6-64.el6, python-tools-2.6.6-64.el6
    • Red Hat Enterprise Linux HPC Node (v. 6) python-2.6.6-64.el6, python-devel-2.6.6-64.el6, python-libs-2.6.6-64.el6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) python-test-2.6.6-64.el6, python-tools-2.6.6-64.el6, tkinter-2.6.6-64.el6
    • Red Hat Enterprise Linux Server (v. 6) python-2.6.6-64.el6, python-devel-2.6.6-64.el6, python-devel-2.6.6-64.el6.ppc +3
    • Red Hat Enterprise Linux Server Optional (v. 6) python-test-2.6.6-64.el6, python-tools-2.6.6-64.el6, tkinter-2.6.6-64.el6
    • Red Hat Enterprise Linux Workstation (v. 6) python-2.6.6-64.el6, python-devel-2.6.6-64.el6, python-libs-2.6.6-64.el6 +1
    • Red Hat Enterprise Linux Workstation Optional (v. 6) python-test-2.6.6-64.el6, python-tools-2.6.6-64.el6
  • RHSA-2015:1064 Released 2015-06-04 · Red Hat rating Moderate
    python27 security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) python27-1.1-17.el6, python27-python-2.7.8-3.el6, python27-python-debug-2.7.8-3.el6 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-1.1-20.el7, python27-python-2.7.8-3.el7, python27-python-debug-2.7.8-3.el7 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) python27-1.1-17.el6, python27-python-2.7.8-3.el6, python27-python-debug-2.7.8-3.el6 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) python27-1.1-17.el6, python27-python-2.7.8-3.el6, python27-python-debug-2.7.8-3.el6 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) python27-1.1-17.el6, python27-python-2.7.8-3.el6, python27-python-debug-2.7.8-3.el6 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-1.1-20.el7, python27-python-2.7.8-3.el7, python27-python-debug-2.7.8-3.el7 +11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix yet
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2015:2101
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2015:2101
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2015:2101
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2015:2101
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2015:1330
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2015:1330
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2015:1330
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2015:1330
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2015:1330
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2015:2101
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2015:1330
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2015:2101
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2015:1330
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2015:2101
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2015:1330
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2015:2101
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2015:1064
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2015:1064
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5)Fixed RHSA-2015:1064
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)Fixed RHSA-2015:1064
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2015:1064
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2015:1064
Not affected: 1 product
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-4650
  2. 2026-10-03 Alias added: GHSA-33c8-ggqv-8g5p

References

Exploit 1

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences