Unrated
MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_...
CVE-2021-32062
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-32062 mapserver Fixed in: 7.6.2-2
- Ubuntu UBUNTU-CVE-2021-32062 mapserver
Original description The description as published by the source.
MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI).
References
- advisory mapserver.org
- advisory mapserver.org
- advisory mapserver.org
- advisory mapserver.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org