Summary
It was discovered that Yaws did not properly sanitize XML input. A remote
attacker could use this vulnerability to execute an XML External Entity
(XXE) injection attack. (CVE-2020-24379)
It was discovered that Yaws mishandled certain input when running CGI
scripts. A remote attacker could use this vulnerability to execute
arbitrary commands. (CVE-2020-24916)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | yaws | 2.0.4+dfsg-2ubuntu0.1 |
Vulnerabilities 2
-
Unscored —
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
-
Unscored —CVE-2020-24916 EPSS 17%
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.