CVE-2018-19052 An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_a...
HighCVSS 7.5
EPSS 13.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lighttpd(Debian:12) | < 1.4.52-1 | 1.4.52-1 |
| debian/lighttpd(Debian:13) | < 1.4.52-1 | 1.4.52-1 |
| debian/lighttpd(Debian:14) | < 1.4.52-1 | 1.4.52-1 |
| lighttpd | < 1.4.50 | 1.4.50 |
| openSUSE backports sle | = 15.0 | No fix listed |
| openSUSE backports sle | = 15.0-sp1 | No fix listed |
| openSUSE leap | = 15.0 | No fix listed |
| openSUSE leap | = 15.1 | No fix listed |
| suse linux enterprise server | = 11-sp3 | No fix listed |
| suse linux enterprise server | = 11-sp4 | No fix listed |
| suse linux enterprise server | = 12 | No fix listed |
| suse linux enterprise server | = 12-sp1 | No fix listed |
| suse linux enterprise server | = 12-sp2 | No fix listed |
| suse linux enterprise server | = 12-sp3 | No fix listed |
| suse linux enterprise server | = 12-sp4 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-19052 vendor-advisory
- openSUSE-SU-2019:2347 mailing-list third-party-advisory vendor-advisory
- github.com exploit vendor-advisory
- [debian-lts-announce] 20220118 [SECURITY] [DLA 2879-1] lighttpd security update mailing-list third-party-advisory
- bugs.debian.org issue-tracking