OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-02-23 15:38:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add tower-http 2022 version (#1320)

Browse Source
This commit is contained in:
pinkforest(she/her)
2022-08-05 08:06:52 +10:00
committed by GitHub
parent 0db59724bf
commit 2827f80af4
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
crates/tower-http/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,28 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "tower-http"
date = "2022-01-21"
url = "https://github.com/tower-rs/tower-http/pull/204"
categories = ["file-disclosure"]
keywords = ["directory traversal", "http"]
[affected]
os = ["windows"]
[versions]
patched = [">= 0.2.1", ">= 0.1.3, < 0.2.0"]
```
# Improper validation of Windows paths could lead to directory traversal attack
`tower_http::services::fs::ServeDir` didn't correctly validate Windows paths
meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed
and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users
could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
See [tower-http#204] for more details.
[tower-http#204]: https://github.com/tower-rs/tower-http/pull/204