[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAE_88GZuxbwSuZy+oNqGLZj9hWHiyy7n7FhJY-fza_e0UinJjg@mail.gmail.com>
Date: Fri, 13 Sep 2019 11:25:20 -0300
From: "Thiago H. de Paula Figueiredo" <thiagohp@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2019-0207: Apache Tapestry 5.4.2 Path Traversal vulnerability
CVE-2019-0207: Apache Tapestry 5.4.2 Path Traversal vulnerability
Severity: important
Vendor: The Apache Software Foundation
Versions affected: all Apache Tapestry versions between 5.4.0, including
its betas, and 5.4.4
Description: Tapestry processes assets `/assets/ctx` using classes chain
`StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't
filter the character `\`, so attacker can perform a path traversal attack
to read any files on Windows platform.
Mitigation:
Upgrade to Tapestry 5.4.5, which is a drop-in replacement for any 5.4.x
version.
Credit:
Ricter Zheng
--
Thiago
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
