[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150410232241.GS2456@yuggoth.org>
Date: Fri, 10 Apr 2015 23:22:42 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: OSS Security <oss-security@...ts.openwall.com>
Cc: CVE Request <cve-assign@...re.org>,
Etherpad Security <security@...erpad.org>,
John McLear <John@...ear.co>, Tom Hunkapiller <tom@...ycodes.com>,
Stefan Müller <stefan@...fans-entwicklerecke.de>
Subject: CVE Request for read-only directory traversal in Etherpad Minify
A vulnerability was discovered in Etherpad (see below). In order to
ensure full traceability, we need a CVE number assigned that we can
attach to further notifications. This issue is already public.
Title: Read-only directory traversal in Etherpad Minify
Reporter: Tom Hunkapiller
Versions: 1.1.2 through 1.5.2
Description:
Tom Hunkapiller reported a vulnerability in the minify feature of
current Etherpad releases. Backslashes are replaced with slashes in
the path parameter of HTTP API calls after path normalization is
applied, allowing an attacker supplying specially-crafted requests
to remotely read arbitrary files on the server's filesystem with the
privileges of the account running the service.
Notes:
This bug was introduced in commit a97b83b which was initially
included in the 1.1.2 release, and is fixed in commit 9d4e5f6 which
will appear in a future 1.5.3 release.
References:
https://github.com/ether/etherpad-lite/commit/9d4e5f6
--
Jeremy Stanley
Download attachment "signature.asc" of type "application/pgp-signature" (950 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
