Unrated
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include"...
CVE-2018-17567
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2018-17567 jekyll Fixed in: 3.8.3+dfsg-3.1
Original description The description as published by the source.
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- patch github.com
- patch jekyllrb.com
- web lists.apache.org