Log in Sign up KO

—

PYSEC-2018-78

Details

uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.

Are you affected?

Enter the version of the package you're using.

Affected packages

Introduced in: 0 Fixed in: 2.0.17

Fix pip install --upgrade 'uwsgi>=2.0.17'

References

https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.17.html [WEB]
https://www.exploit-db.com/exploits/44223/ [WEB]
https://www.debian.org/security/2018/dsa-4142 [ADVISORY]
https://github.com/advisories/GHSA-h2vm-c85r-5vh5 [ADVISORY]