Wind River Support Network

HomeDefectsLIN1018-5042

Fixed

LIN1018-5042 : Security Advisory - python - CVE-2019-16935

Created: Oct 7, 2019 Updated: May 13, 2022

Resolved Date: Nov 3, 2019

Found In Version: 10.18.44.1

Fix Version: 10.18.44.12

Severity: Standard

Applicable for: Wind River Linux LTS 18

Component/s: Userspace

Description

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

CREATE(Triage):(User=admin) CVE-2019-16935 (https://nvd.nist.gov/vuln/detail/CVE-2019-16935)

CVEs

CVE-2019-16935