Wow, that is long ago. Why isn't this mitigated earlier? The attack is very simple.
March 2001 - The issue is discovered in libwww-perl and fixed. Reported by Randal L. Schwartz.
AFAIK, uWSGI somewhat resembles but doesn't emulate CGI (unlike how FastCGI works), and WSGI application's `environ` parameter isn't related to `os.environ`, so it should be safe. But I may be mistaken here...
----
Python code must be deployed under CGI to be vulnerable. Usually, that’ll mean the vulnerable code will use a CGI handler like wsgiref.handlers.CGIHandler
This is not considered a normal way of deploying Python webapps (most people are using WSGI or FastCGI, both of which are not affected),
Saying Nginx is vulnerable is like saying that the Linux kernel is vulnerable to heartbleed.
Whoever the f*ck had the briliant idea to alter the environment variables of a server child process through incoming HTTP headers should have his browsers environment variables altered by the servers responses.
