USN-8995-1: yaws vulnerabilities
It was discovered that Yaws did not properly sanitize XML input in its WebDAV implementation. A remote attacker could possibly use this issue to perform XML external entity injection attacks. (CVE-2020-24379)
It was discovered that Yaws mishandled certain input when running CGI scripts. A remote attacker could possibly use this issue to execute arbitrary commands. (CVE-2020-24916)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/yawsto a version that resolves this vulnerability.Fixed in 2.0.2-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/yawsto a version that resolves this vulnerability.Fixed in 2.0.7+dfsg-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/erlang-yawsto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/yawsto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/erlang-yawsto a version that resolves this vulnerability.Fixed in 2.0.2-1ubuntu0.1~esm1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Yaws functionality is relevant to each issue?
The XML external entity injection issue is in Yaws WebDAV handling, so WebDAV XML processing is the relevant exposure. The command-execution issue applies when Yaws is running CGI scripts.
Does exploitation require an attacker to have local access?
No. Both issues are described as exploitable by a remote attacker. The available information does not state whether authentication or any other access prerequisite is required.