It's "Lib/DocXMLRPCServer.py" in python2x or "Lib/xmlrpc/server.py" in python3x.Steps to reproduce:1.Lib/DocXMLRPCServer.py is “a documenting XML-RPC Server“,In the Class ServerHTMLDoc, method markup(), will escape the Special symbols to safe(such as <," etc).2.But it only escape the content from server.set_server_name() and server.set_server_documentation(),the "title" content from the server.set_server_title() will not be escaped, so if I set_server_title('123</title><script>alert(1)</script>'), it will cause XSS because not escaped.3.I see the alert in Chrome by visitinghttp://127.0.0.1,the Poc is the poc.py（run in python2.7） in attachments.4.Problems seems to be athttps://github.com/python/cpython/blob/master/Lib/xmlrpc/server.py#L897 "return documenter.page(self.server_title,documentation)".Before this line,variable "documentation" has been escaped but self.server_title not.This is the main cause.

Thanks for the report. There is a policy to report security vulnerabilities in CPython :https://www.python.org/news/security/.

Looks like this issue can be solved by below code changed.@@ -833,7 +834,7 @@ class XMLRPCDocGenerator:     def set_server_title(self, server_title):         """Set the HTML title of the generated server documentation"""-        self.server_title = server_title+        self.server_title = html.escape(server_title)

I've proposed the patch on GitHub which escaping the server_title when the documenter.page is called. (It different point withmsg353132.

> Thanks for the report. There is a policy to report security vulnerabilities in CPython :https://www.python.org/news/security/.The private security mailing list has been contacted first and we advice to open a public issue since we consider that it's not a major security issue.To exploit this bug, the attacker has to control the XML-RPC server title.

> I've proposed the patch on GitHub which escaping the server_title when the documenter.page is called. (It different point withmsg353132.The attached poc.py seems to show that server name and server documentation are not escaped neither.server.set_server_name('test<script>')server.set_server_documentation('test<script>')Well, please write a test to check that ;-)

@vstinnerThank you for the feedback.I've updated the PR with the unit test you suggested :-)

New changesete8650a4f8c7fb76f570d4ca9c1fbe44e91c8dfaa by Victor Stinner (Dong-hee Na) in branch 'master':bpo-38243, xmlrpc.server: Escape the server_title (GH-16373)https://github.com/python/cpython/commit/e8650a4f8c7fb76f570d4ca9c1fbe44e91c8dfaa

New changeset39a0c7555530e31c6941a78da19b6a5b61170687 by Miss Islington (bot) in branch '3.7':bpo-38243, xmlrpc.server: Escape the server_title (GH-16373)https://github.com/python/cpython/commit/39a0c7555530e31c6941a78da19b6a5b61170687

New changeset6447b9f9bd27e1f6b04cef674dd3a7ab27bf4f28 by Miss Islington (bot) in branch '3.8':bpo-38243, xmlrpc.server: Escape the server_title (GH-16373)https://github.com/python/cpython/commit/6447b9f9bd27e1f6b04cef674dd3a7ab27bf4f28

@Dong-hee Na: Would you mind to try to backport the change to Python 2.7 which also has the bug?

Sure!

New changeset1698cacfb924d1df452e78d11a4bf81ae7777389 by Ned Deily (Victor Stinner) in branch '3.6':bpo-38243, xmlrpc.server: Escape the server_title (GH-16373) (GH-16441)https://github.com/python/cpython/commit/1698cacfb924d1df452e78d11a4bf81ae7777389

New changeset8eb64155ff26823542ccf0225b3d57b6ae36ea89 by Victor Stinner (Dong-hee Na) in branch '2.7':[2.7]bpo-38243: Escape the server title of DocXMLRPCServer (GH-16447)https://github.com/python/cpython/commit/8eb64155ff26823542ccf0225b3d57b6ae36ea89

I prefer to keep it open until the 3.5 backport is merged.

> I prefer to keep it open until the 3.5 backport is merged.Sorry, I didn't find it.Yes, we should let it open until the PR is merged.

New changeset3fe1b19265b55c290fc956e9aafcf661803782de by larryhastings (Victor Stinner) in branch '3.5':bpo-38243, xmlrpc.server: Escape the server_title (GH-16373) (GH-16441) (#16516)https://github.com/python/cpython/commit/3fe1b19265b55c290fc956e9aafcf661803782de

CVE-2019-16935 has been assigned to this vulnerability.

Charalampos Strataris's advice: If you backport the security fix and test_docxmlrpc starts to hang randomly, you should also backportbpo-27614 fix. For example, it's the commit3911d8333c5b6f9374fa11ab7c912f1471580f0f for Python 2.7. We had the issue on RHEL 7.