3 ms·
There are mentions of Python... Does this affect WSGI applications, in particular, uWSGI? AFAIK, uWSGI somewhat resembles but doesn't emulate CGI (unlike how F
by drdaeman 10y ago
There are mentions of Python... Does this affect WSGI applications, in particular, uWSGI?
AFAIK, uWSGI somewhat resembles but doesn't emulate CGI (unlike how FastCGI works), and WSGI application's `environ` parameter isn't related to `os.environ`, so it should be safe. But I may be mistaken here...
- adrianratnapala 10y agoI don't know about uWSGI, but here is what it says at httproxy.org ---- Python code must be deployed under CGI to be vulnerable. Usually, that’ll mean the vulnerable code will use a CGI handler like wsgiref.handlers.CGIHandler This is not considered a normal way of deploying Python webapps (most people are using WSGI or FastCGI, both of which are not affected),
- cleeus 10y agobtw, the reference FastCGI C library libfcgi also alters the environment to emulate legacy CGI and may also be vulnerable (haven't checked).