Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2020-29600 →
DEBIAN-CVE-2020-29600
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/a...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
awstats
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-1"}]}]
Debian:13
awstats
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-1"}]}]
Debian:14
awstats
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-1"}]}]
Références
- advisory security-tracker.debian.org