diff options
| author | Michael Merickel <michael@merickel.org> | 2023-08-24 23:49:50 -0600 |
|---|---|---|
| committer | Michael Merickel <michael@merickel.org> | 2023-08-24 23:49:50 -0600 |
| commit | b4e78bd14f7bbfce76399510a78b5346f9bd73e1 (patch) | |
| tree | c6a3597b7d05ec644ba7093198e7d6a64e8b1c05 /CHANGES.rst | |
| parent | 0919da5326ef65fb6569bc045ee0c0f033185f1c (diff) | |
| parent | 6726314834d0de9e29c45dcb3d6f3ce9118a956d (diff) | |
| download | pyramid-b4e78bd14f7bbfce76399510a78b5346f9bd73e1.tar.gz pyramid-b4e78bd14f7bbfce76399510a78b5346f9bd73e1.tar.bz2 pyramid-b4e78bd14f7bbfce76399510a78b5346f9bd73e1.zip | |
Merge branch 'tseaver-jp_exploit_fix'
Diffstat (limited to 'CHANGES.rst')
| -rw-r--r-- | CHANGES.rst | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/CHANGES.rst b/CHANGES.rst index 035162a14..46f7fbc18 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -14,9 +14,22 @@ Features Bug Fixes --------- +- Removed support for null-bytes in the path when making a request for a file + against a static_view. Whille null-bytes are allowed by the HTTP + specification, due to the handling of null-bytes potentially leading to + security vulnerabilities it is no longer supported. + + This fixes a security vulnerability that is present due to a bug in Python + 3.11.0 through 3.11.4, thereby allowing the unintended disclosure of an + ``index.html`` one directory up from the static views path. + + Thanks to Masashi Yamane of LAC Co., Ltd for reporting this issue. + Backward Incompatibilities -------------------------- +- Requests to a static_view are no longer allowed to contain a null-byte in any + part of the path segment. - Pyramid is no longer tested on, nor supports Python 3.6 - Pyramid drops support for l*gettext() methods in the i18n module. These have been deprecated in Python's gettext module since 3.8, and |