Threats tagged 'ghsa-cp25-j9x5-p5xm'

The urwid library version 4.0.6 and earlier contains a vulnerability in the handle_short_request() function where processing a POST request body with non-ASCII bytes causes an unhandled UnicodeEncodeError, crashing the CGI process and returning HTTP 500 errors. This also leads to a file descriptor leak. A similar issue exists in the polling update path with non-UTF-8 socket output causing UnicodeDecodeError. The flaw enables denial of service for legitimate users of the urwid web interface. The issue is fixed in version 4.0.7.