PT-2018-19288 · Lighttpd · Lighttpd

Publicado 2018-11-03 · Atualizado 2018-11-03

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions lighttpd (affected versions not specified)

Description The issue involves several security concerns, including potential path traversal in mod alias under specific configurations or use cases, use-after-free errors due to invalid Range requests in the core, processing headers after combining folded headers in the core, and skipping usernames "." and ".." in mod userdir.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

MGASA-2018-0430

Produtos afetados

Lighttpd

Referências · 5

• https://lighttpd.net/2018/10/14/1.4.51 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=23443 · Nota
• https://osv.dev/vulnerability/MGASA-2018-0430 · Aviso do Fabricante
• http://lighttpd.net/2018/8/13/1.4.50 · Nota
• https://advisories.mageia.org/MGASA-2018-0430.html · Nota de Segurança