Description
Yaws Webserver 1.55 and earlier allows remote attackers to obtain the source code for yaws scripts via a request to a yaw script with a trailing %00 (null).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | yaws | 1.56-1 | — |
| Debian 13 | yaws | 1.56-1 | — |
| Debian 12 | yaws | 1.56-1 | — |
References
- 17375 vdb-entry
- 20050617 Source Code Disclosure in Yaws Webserver <1.56 mailing-list
- http://yaws.hyber.org/yaws-1.55_to_1.56.patch
- 15740 third-party-advisory