CVE-2019-17640: Path Traversal
First published: Thu Oct 15 2020(Updated: )
In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.
Credit: emo@eclipse.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eclipse Vert.x | >=3.4.0<=3.9.4 | |
| Eclipse Vert.x | =4.0.0-beta1 | |
| Eclipse Vert.x | =4.0.0-beta2 | |
| Eclipse Vert.x | =4.0.0-beta3 | |
| Eclipse Vert.x | =4.0.0-milestone1 | |
| Eclipse Vert.x | =4.0.0-milestone2 | |
| Eclipse Vert.x | =4.0.0-milestone3 | |
| Eclipse Vert.x | =4.0.0-milestone4 | |
| Eclipse Vert.x | =4.0.0-milestone5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=567416
- https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941@%3Ccommits.servicecomb.apache.org%3E
- https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rfd0ebf8387cfd0b959d1e218797e709793cce51a5ea2f84d0976f47d@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941%40%3Ccommits.servicecomb.apache.org%3E
- https://lists.apache.org/thread.html/rfd0ebf8387cfd0b959d1e218797e709793cce51a5ea2f84d0976f47d%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33%40%3Ccommits.pulsar.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2019-17640?
CVE-2019-17640 has a medium severity rating due to its potential to allow directory traversal on Windows systems.
How do I fix CVE-2019-17640?
To mitigate CVE-2019-17640, upgrade to the latest version of Eclipse Vert.x that addresses this vulnerability.
Which versions of Eclipse Vert.x are affected by CVE-2019-17640?
Eclipse Vert.x versions 3.4.0 to 3.9.4 and various 4.0.0 milestones and betas are affected by CVE-2019-17640.
What impact does CVE-2019-17640 have on vulnerable systems?
CVE-2019-17640 allows attackers to escape the webroot folder, potentially exposing sensitive files on affected Windows systems.
Is there a workaround for CVE-2019-17640?
A workaround for CVE-2019-17640 involves applying restrictions on the StaticHandler configuration to prevent directory traversal.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/eclipse
- canonical/eclipse vert.x
- version/eclipse vert.x/3.4.0
- version/eclipse vert.x/3.9.4
- version/eclipse vert.x/4.0.0-beta1
- version/eclipse vert.x/4.0.0-beta2
- version/eclipse vert.x/4.0.0-beta3
- version/eclipse vert.x/4.0.0-milestone1
- version/eclipse vert.x/4.0.0-milestone2
- version/eclipse vert.x/4.0.0-milestone3
- version/eclipse vert.x/4.0.0-milestone4
- version/eclipse vert.x/4.0.0-milestone5