Summary
It was discovered that Yaws did not properly sanitize XML input in its
WebDAV implementation. A remote attacker could possibly use this issue to
perform XML external entity injection attacks. (CVE-2020-24379)
It was discovered that Yaws mishandled certain input when running CGI
scripts. A remote attacker could possibly use this issue to execute
arbitrary commands. (CVE-2020-24916)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | yaws | 2.0.2-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | yaws | 2.0.7+dfsg-1ubuntu0.1~esm1 |
Vulnerabilities 2
-
Unscored —
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
-
Unscored —CVE-2020-24916 EPSS 17%
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.