[pkg-uWSGI-devel] Fwd: Possible uWSGI security vulnerability

[Alexandre Rossi]

Hi,

>> No ASCII character fulfills the condition of being less than '0' and
>> at the same time greater than '9', for example. Therefore the check is
>> always false.
>>
>> The corrected version is right: it is not an hex character if it is
>> not between 0 and 9 AND not between a and f AND not between A and F.

Thanks for clarifying.

I submitted a fix.
https://github.com/unbit/uwsgi/pull/2778

Not sure of the security implications though.

Alex