Radicale vulnerable to arbitrary file read or write

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2015-8747 · ADVISORY
• Kozea/Radicale#343 · WEB
• Kozea/Radicale commit 18c8864 · WEB
• Unrud/Radicale commit bcaf452 · WEB
• Kozea/Radicale · PACKAGE
• pypa/advisory-database · WEB
• web.archive.org/web/20200804235922/http://www.securityfocus.com/bid/80255 · WEB
• lists.fedoraproject.org/pipermail/package-announce/2016-January/175738.html · WEB
• lists.fedoraproject.org/pipermail/package-announce/2016-January/175776.html · WEB
• debian.org/security/2016/dsa-3462 · WEB
• openwall.com/lists/oss-security/2016/01/05/7 · WEB
• openwall.com/lists/oss-security/2016/01/06/4 · WEB
• openwall.com/lists/oss-security/2016/01/06/7 · WEB
• securityfocus.com/bid/80255
• pypi.org/project/radicale · PACKAGE
• GitHub Advisory GHSA-fgqv-96v9-w23m · ADVISORY

radicale のその他の脆弱性

• CVE-2017-8342高 8.1Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authenticati…
• CVE-2016-1505緊急 10.0The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted p…
• CVE-2015-8748中 5.3Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user …