This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-29600 →

DEBIAN-CVE-2020-29600

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/a...

Original description

The description as published by the source.

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 awstats

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-1"}]}]

Debian:13 awstats

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-1"}]}]

Debian:14 awstats

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-1"}]}]

References

advisory security-tracker.debian.org