UBUNTU-CVE-2020-24379: Critical severity ubuntu/yaws vulnerability
Published Sep 9, 2020
·Updated
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
Affected Software
3 affected componentsFixes available
ubuntu/yaws*
ubuntu/yaws<2.0.4+dfsg-2ubuntu0.1
2.0.4+dfsg-2ubuntu0.1
ubuntu/yaws*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/yawsto a version that resolves this vulnerability.Fixed in 2.0.2-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/yawsto a version that resolves this vulnerability.Fixed in 2.0.4+dfsg-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/yawsto a version that resolves this vulnerability.Fixed in 2.0.7+dfsg-1ubuntu0.1~esm1
Event History
Sep 9, 2020
CVE Published
via OSV·07:15 PM
Data Sourced
via OSV·07:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who is exposed to this issue?
Systems running the Yaws web server with its WebDAV implementation in versions 1.81 through 2.0.7 are affected. The provided severity vector indicates the issue can be reached over the network without authentication or user interaction.
2
What access does an attacker need to exploit it?
An attacker needs network access to the affected WebDAV service. No privileges or user interaction are required according to the supplied CVSS vector.