$NetBSD: patch-Misc_NEWS,v 1.1 2014/07/04 11:37:13 he Exp $ Note we have fix for directory traversal vulnerability, ref. http://bugs.python.org/issue21766 --- Misc/NEWS.orig 2014-05-19 05:19:39.000000000 +0000 +++ Misc/NEWS @@ -93,6 +93,9 @@ Core and Builtins Library ------- +- Issue #21766: Prevent a security hole in CGIHTTPServer by URL unquoting paths + before checking for a CGI script at that path. + - Issue #21088: Bugfix for curses.window.addch() regression in 3.4.0. In porting to Argument Clinic, the first two arguments were reversed.