Description
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config').
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Foundation | Vert.x | 4.0.0 – < 4.5.22, 5.0.0 – < 5.0.5 | 4.5.22 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kafka-strimzi-compat +12 | 0.48.0-r1 | — |
| Wolfi rolling | keycloak-26.4-iamguarded-compat | 26.4.7-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.vertx:vertx-web | < 4.5.22 | 4.5.22 | GHSA-h5fg-jpgr-rv9c |
| Maven | io.vertx:vertx-web | >= 5.0.0, < 5.0.5 | 5.0.5 | GHSA-h5fg-jpgr-rv9c |