CVE-2020-24379

Related Files

Debian Security Advisory 4773-1

Posted Oct 28, 2020

Authored by Debian | Site debian.org

Debian Linux Security Advisory 4773-1 - Two vulnerabilities were discovered in yaws, a high performance HTTP 1.1 webserver written in Erlang.

tags | advisory, web, vulnerability

systems | linux, debian

advisories | CVE-2020-24379, CVE-2020-24916

SHA-256 | 0c213b73840806d1cb1fe8a49cac06cb5bd45039df5ae7cc8dc5abd7613a84db

Download | Favorite | View

Ubuntu Security Notice USN-4569-1

Posted Oct 5, 2020

Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4569-1 - It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this vulnerability to execute an XML External Entity injection attack. It was discovered that Yaws mishandled certain input when running CGI scripts. A remote attacker could use this vulnerability to execute arbitrary commands.

tags | advisory, remote, arbitrary, cgi

systems | linux, ubuntu

advisories | CVE-2020-24379, CVE-2020-24916

SHA-256 | 8427560bcb397eab5a79c38d2dd2ed9f39fe10fa9dd337ea9c02b328aeac99b1

Download | Favorite | View

Yaws 2.0.7 XML Injection / Command Injection

Posted Sep 8, 2020

Authored by Alexey Pronin

Yaws versions 1.81 through 2.0.7 suffer from remote OS command injection and XML external entity injection vulnerabilities.

tags | exploit, remote, vulnerability

advisories | CVE-2020-24379, CVE-2020-24916

SHA-256 | a545a3172fc55a8fbfa7ccde9eb9fa21f07d84ee1822019489b84a0f3a5dc7d7

Download | Favorite | View