Description
The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | radicale | < 1.1 | 1.1 | GHSA-84cw-mxhv-qvv4 |
References
- [oss-security] 20160106 Re: CVE request for radicale mailing-list
- 80255 vdb-entry
- https://github.com/Unrud/Radicale/commit/b4b3d51f33c7623d312f289252dd7bbb8f58bbe6
- [oss-security] 20160105 CVE request for radicale mailing-list
- https://github.com/Kozea/Radicale/pull/343
- [oss-security] 20160106 Re: CVE request for radicale mailing-list
- [oss-security] 20160107 Re: CVE request for radicale mailing-list