Date: Fri, 13 Sep 2019 11:25:20 -0300 From: "Thiago H. de Paula Figueiredo" <thiagohp@...il.com> To: oss-security@...ts.openwall.com Subject: CVE-2019-0207: Apache Tapestry 5.4.2 Path Traversal vulnerability CVE-2019-0207: Apache Tapestry 5.4.2 Path Traversal vulnerability Severity: important Vendor: The Apache Software Foundation Versions affected: all Apache Tapestry versions between 5.4.0, including its betas, and 5.4.4 Description: Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform. Mitigation: Upgrade to Tapestry 5.4.5, which is a drop-in replacement for any 5.4.x version. Credit: Ricter Zheng -- Thiago
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.