CVE-2004-1444

描述

Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via `..` (dot dot) sequences in an `@@` command in an HTTP GET request.

如何修補 CVE-2004-1444

要修補 CVE-2004-1444,請將受影響套件升級到下列已修補版本。

• PyPI/roundup—升級至 0.7.3 或更新版本
• PyPI/roundup—升級至 0.7.3 或更新版本

CVE-2004-1444 正在被利用嗎?

中等 — EPSS 為 8.8%,可持續追蹤但非最高優先。

受影響套件(2)

• from 0, < 0.7.3
• from 0, < 0.7.3

參考連結(11)

• ADVISORYgithub.com/advisories/GHSA-q7mf-hp9m-cx6f
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2004-1444
• PATCHgithub.com/roundup-tracker/roundup
• PATCHpypi.org/project/roundup
• WEBpacketstormsecurity.nl