CVE request: XSS in python paste

[Raphael Geissert <geissert () debian org>]

Hi,

Quoting [1]:

> Paste 1.7.4 is released.  The only real change is to paste.httpexceptions, 
> which was using insecure quoting of some parameters and allowed an XSS 
> hole, 
> most specifically with its 404 messages.  The most notably WSGI 
> application 
> using this is paste.urlparse.StaticURLParser and PkgResourcesParser.  By 
> directing someone to an appropriately formed URL an attacker can execute 
> arbitrary Javascript on the victim's client.  paste.urlmap.URLMap is also 
> affected, but only if you have no application attached to /.  Other 
> applications using paste.httpexceptions may be effected (especially 
> HTTPNotFound).  WebOb/webob.exc.HTTPNotFound is not affected. 

The commit fixing this bug appears to be:
http://bitbucket.org/ianb/paste/changeset/fcae59df8b56
Homepage:
http://pythonpaste.org/

Could a CVE be assigned?

Thanks in advance.

[1] http://groups.google.com/group/paste-
users/browse_thread/thread/3b3fff3dadd0b1e5?pli=1

Regards,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net