Bug 432777 (CVE-2008-0252) - CVE-2008-0252 python-cherrypy directory traversal
Summary: CVE-2008-0252 python-cherrypy directory traversal
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-0252
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:
Depends On: 427664
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-02-14 11:06 UTC by Mark J. Cox
Modified: 2008-02-19 01:06 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-02-14 11:11:35 UTC
Embargoed:


Attachments (Terms of Use)

Description Mark J. Cox 2008-02-14 11:06:26 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-0252 to the following vulnerability:

Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.

References:

http://www.securityfocus.com/archive/1/archive/1/487001/100/0/threaded
http://www.cherrypy.org/changeset/1774
http://www.cherrypy.org/changeset/1775
http://www.cherrypy.org/changeset/1776
http://www.cherrypy.org/ticket/744
https://bugs.gentoo.org/show_bug.cgi?id=204829
https://issues.rpath.com/browse/RPL-2127
http://www.debian.org/security/2008/dsa-1481
http://security.gentoo.org/glsa/glsa-200801-11.xml
http://www.securityfocus.com/bid/27181
http://www.frsirt.com/english/advisories/2008/0039
http://secunia.com/advisories/28354
http://secunia.com/advisories/28611
http://secunia.com/advisories/28620
http://secunia.com/advisories/28769

Fix:

http://www.cherrypy.org/changeset/1775

Comment 2 Robert Buchholz 2008-02-19 01:06:44 UTC
Fedora fixed this already in bug 427665.


Note You need to log in before you can comment on or make changes to this bug.