python-markdown2 Multiple Security Vulnerabilities

Bugtraq ID:	36829
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 27 2009 12:00AM
Updated:	May 07 2015 05:16PM
Credit:	Reported by the vendor.
Vulnerable:	python-markdown2 python-markdown2 1.0.1 .14
Not Vulnerable:	python-markdown2 python-markdown2 1.0.1 .15

python-markdown2 Multiple Security Vulnerabilities

The 'python-markdown2' module is prone to two vulnerabilities because it fails to sufficiently sanitize user-supplied input:

1. A cross-site scripting issue may allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

2. The impact of the second issue is unknown.

These issues affects python-markdown2 1.0.1.14 and earlier.

python-markdown2 Multiple Security Vulnerabilities

Attackers can exploit these issues via a browser. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting victim into following a malicious URI.

python-markdown2 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for details.

python-markdown2 Multiple Security Vulnerabilities

References:

• python-markdown2 Homepage (python-markdown2)
  
• python-markdown2 Changelog (python-markdown2)