rustsec/advisory-db
1
0
Fork 0
mirror of https://github.com/rustsec/advisory-db.git synced 2025-12-27 01:54:07 -05:00
Code Issues Packages Projects Releases Wiki Activity
Files
d3eccc4072029426f69c1736d66d85d23d8c4e0a
advisory-db/crates/tower-http/RUSTSEC-2021-0135.md
pinkforest(she/her) d3eccc4072 Remove yanked 2 (#1364) 
* Remove yanked 2

Signed-off-by: pinkforest <36498018+pinkforest@users.noreply.github.com>

* Test cache

* Cache back on

* Bump audit cache

Signed-off-by: pinkforest <36498018+pinkforest@users.noreply.github.com>

Signed-off-by: pinkforest <36498018+pinkforest@users.noreply.github.com>
2022-08-16 12:38:08 +10:00

954 B
Raw Blame History 

[advisory]
id = "RUSTSEC-2021-0135"
package = "tower-http"
date = "2021-01-21"
url = "https://github.com/tower-rs/tower-http/pull/204"
categories = ["file-disclosure"]
keywords = ["directory traversal", "http"]
withdrawn = "2022-08-14" # fixing date to 2022-01-21 see rustsec/advisory-db#1165

[affected]
os = ["windows"]

[versions]
patched = [">= 0.2.1", ">= 0.1.3, < 0.2.0"]

Improper validation of Windows paths could lead to directory traversal attack

tower_http::services::fs::ServeDir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

See tower-http#204 for more details.