OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2025-12-30 08:13:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add advisory for warp#937 (#1544)

Browse Source 
* Add advisory for warp#937

* Change date to time of initial report
This commit is contained in:
Nathaniel Daniel
2023-01-28 15:45:42 -08:00
committed by GitHub
parent bed742d611
commit b2314e4e65
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
crates/warp/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,24 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "warp"
date = "2022-01-14"
url = "https://github.com/seanmonstar/warp/issues/937"
categories = ["file-disclosure"]
keywords = ["directory traversal", "http"]
[affected]
os = ["windows"]
[versions]
patched = [">= 0.3.3"]
```
# Improper validation of Windows paths could lead to directory traversal attack
Path resolution in `warp::filters::fs::dir` didn't correctly validate Windows paths
meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed
and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users
could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.