REDHAT-BUG-697229: Medium severity mojolicious vulnerability
A directory traversal flaw was found in Mojolicious [1]. Because Mojolicious did not unescape paths before processing them, a user could use it to view arbitrary files using '%2f' rather than '/' (for example: %2f..%2f). This has been corrected in upstream version 1.17 [2].
[1] https://github.com/kraih/mojo/issues/114 [2] https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-697229?
The severity of REDHAT-BUG-697229 is classified as high due to the potential for unauthorized file access.
How do I fix REDHAT-BUG-697229?
To fix REDHAT-BUG-697229, upgrade Mojolicious to version 1.17 or later.
What kind of vulnerability is REDHAT-BUG-697229?
REDHAT-BUG-697229 is a directory traversal vulnerability that allows access to arbitrary files.
Which versions of Mojolicious are affected by REDHAT-BUG-697229?
Mojolicious versions prior to 1.17 are affected by REDHAT-BUG-697229.
How does the directory traversal in REDHAT-BUG-697229 work?
The directory traversal in REDHAT-BUG-697229 allows users to exploit unescaped paths, enabling access to files using encoded sequences like '%2f'.