PT-2018-19288 · Lighttpd · Lighttpd

Published 2018-11-03 · Updated 2018-11-03

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions lighttpd (affected versions not specified)

Description The issue involves several security concerns, including potential path traversal in mod alias under specific configurations or use cases, use-after-free errors due to invalid Range requests in the core, processing headers after combining folded headers in the core, and skipping usernames "." and ".." in mod userdir.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2018-0430

Affected Products

Lighttpd

References · 5

• https://osv.dev/vulnerability/MGASA-2018-0430 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0430.html · Security Note
• https://lighttpd.net/2018/10/14/1.4.51 · Note
• https://bugs.mageia.org/show_bug.cgi?id=23443 · Note
• http://lighttpd.net/2018/8/13/1.4.50 · Note