Synopsis: Important: mod_wsgi security update Advisory ID: SLSA-2014:0788-1 Issue Date: 2014-06-25 CVE Numbers: CVE-2014-0240 CVE-2014-0242 -- It was found that mod_wsgi did not properly drop privileges if the call to setuid() failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. (CVE-2014-0240) Note: mod_wsgi is not intended to provide privilege separation for WSGI applications. Systems relying on mod_wsgi to limit or sandbox the privileges of mod_wsgi applications should migrate to a different solution with proper privilege separation. It was discovered that mod_wsgi could leak memory of a hosted web application via the "Content-Type" header. A remote attacker could possibly use this flaw to disclose limited portions of the web application's memory. (CVE-2014-0242) -- SL6 x86_64 mod_wsgi-3.2-6.el6_5.x86_64.rpm mod_wsgi-debuginfo-3.2-6.el6_5.x86_64.rpm i386 mod_wsgi-3.2-6.el6_5.i686.rpm mod_wsgi-debuginfo-3.2-6.el6_5.i686.rpm srpm mod_wsgi-3.2-6.el6_5.src.rpm - Scientific Linux Development Team