Multiple vulnerabilities have been identified and fixed in python:

The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module
in Python 2.5, 2.6, and 3.0 allows remote attackers to read script
source code via an HTTP GET request that lacks a / (slash) character
at the beginning of the URI (CVE-2011-1015).

A flaw was found in the Python urllib and urllib2 libraries where
they would not differentiate between different target URLs when
handling automatic redirects. This caused Python applications using
these modules to follow any new URL that they understood, including
the file:// URL type. This could allow a remote server to force a
local Python application to read a local file instead of the remote
one, possibly exposing local files that were not meant to be exposed
(CVE-2011-1521).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct this issue.