Debian/yaws: high 7.5
Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial /%5C sequence to defeat traversal protect
Action: Upgrade yaws to 1.91-2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.91-2 | - |
Fixed versions
| 1.91-2 |
Sources
- osv: DEBIAN-CVE-2017-10974#Debian:14/yaws
- https://security-tracker.debian.org/tracker/CVE-2017-10974
published · modified · JSON