14 DAY TRIAL // The Python Software Foundation has released Python 2.5.6 as a security update in order to address several security vulnerabilities of moderate risk.
First of all, the new release strengthens cross-site scripting (XSS) protection by adding a charset parameter to the Content-type in SimpleHTTPServer.
One of the patched vulnerabilities, CVE-2011-1521, stems from a bug in the way ftp:// and file:// URL schemes are handled in the Python urllib and urllib2 extensible libraries.
A remote attacker could exploit this flaw to access sensitive information or cause a denial of service (excessive CPU and memory use) of a Python web application by serving it specially-crafted urllib open URL requests, for example file:///etc/passwd or file:///dev/zero.
The second vulnerability, CVE-2010-1634, also allows attackers to execute denial of service attacks against Python applications and is the result of multiple integer overflows in audioop.c.
This vulnerability is rated as moderately critical by Secunia and was accidentally introduced along with a fix for an older security flaw, CVE-2008-3143.5.
The third vulnerability patched in Python 2.5.6, CVE-2010-2089, is also located in the audioop module and stems from the fact that relationships between size arguments and byte string lengths are not verified.
This vulnerability is also rated as moderately critical and can be exploited to cause a denial of service condition by sending specially-crafted arguments, like a one-byte string call to audioop.reverse.
According to developers, this is most likely the last release for the Python 2.5 branch, which will no longer be supported after October 2011. Users are strongly encouraged to upgrade to the latest version of the Python 2.7 branch, which at this time is 2.7.1.
The Python 2.5.6 source can be downloaded from here.