Skip to content

[GHSA-6vhp-hp77-6w52] Trac HTML WikiProcessor cross-site scripting (XSS) vulnerability #5636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: rhdesmond/advisory-improvement-5636
Choose a base branch
from

Conversation

rhdesmond
Copy link

Updates

  • Affected products
  • CVSS v3

Comments
Correcting patched version: https://github.com/pypa/advisory-database/blob/main/vulns/trac/PYSEC-2005-1.yaml

@github-actions github-actions bot changed the base branch from main to rhdesmond/advisory-improvement-5636 May 23, 2025 17:22
@shelbyc
Copy link
Contributor

shelbyc commented May 27, 2025

Hi @rhdesmond, my teammates and I chose 0.9-stable as the fixed version because https://trac.edgewall.org/ticket/2473#comment:7 indicates that a fix for CVE-2005-4644 is present in 0.9-stable, but some other resources such as https://trac.edgewall.org/ticket/2473#comment:6 and https://web.archive.org/web/20200302062847/https://www.securityfocus.com/bid/16198/solution indicate 0.9.3 could also be acceptable. Where are you and/or PyPA getting 10.0?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants