OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-21 10:58:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add advisory for tower-http#204 (#1159)

Browse Source
This commit is contained in:
David Pedersen
2022-01-21 16:17:08 +01:00
committed by GitHub
parent d4c65da07d
commit ff5b44566d
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
crates/tower-http/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,28 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "tower-http"
date = "2021-01-21"
url = "https://github.com/tower-rs/tower-http/pull/204"
categories = ["file-disclosure"]
keywords = ["directory traversal", "http"]
[affected]
os = ["windows"]
[versions]
patched = [">= 0.2.1"]
```
# Improper validation of Windows paths could lead to directory traversal attack
`tower_http::services::fs::ServeDir` didn't correctly validate Windows paths
meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed
and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users
could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
See [tower-http#204] for more details.
[tower-http#204]: https://github.com/tower-rs/tower-http/pull/204