Homepage

Cross-site Scripting (XSS) The advisory has been revoked - it doesn't affect any version of package python-idle  (opens in a new tab)

Threat Intelligence

EPSS
4.65% (91st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES150-PYTHONIDLE-2728641
  • published14 Apr 2022
  • disclosed22 Oct 2019
Report a new vulnerability Found a mistake?

Introduced: 22 Oct 2019

CVE-2019-16935  (opens in a new tab)
CWE-79  (opens in a new tab)

Amendment

The SLES security team deemed this advisory irrelevant for SLES:15.0.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-idle package and not the python-idle package as distributed by SLES.

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

References