CVE-2014-3744

描述

Versions of `st` prior to 0.2.5 are affected by a directory traversal vulnerability. Vulnerable versions fail to properly handle URL encoded dots, which caused `%2e` to be interpreted as `.` by the filesystem, resulting the potential for an attacker to read sensitive files on the server. ## Recommendation Update to version 0.2.5 or later.

如何修補 CVE-2014-3744

要修補 CVE-2014-3744,請將受影響套件升級到下列已修補版本。

• —升級至 0.2.5 或更新版本

CVE-2014-3744 正在被利用嗎?

中等 — EPSS 為 34.0%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 0.2.5

CVSS 分數

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-3744
• PATCHgithub.com/isaacs/st
• WEBwww.openwall.com/lists/oss-security/2014/05/13/1
• WEBwww.openwall.com/lists/oss-security/2014/05/15/2
• WEBwww.securityfocus.com