From ff5b44566dd744ef3468a90aaea0145502754424 Mon Sep 17 00:00:00 2001 From: David Pedersen Date: Fri, 21 Jan 2022 16:17:08 +0100 Subject: [PATCH] Add advisory for tower-http#204 (#1159) --- crates/tower-http/RUSTSEC-0000-0000.md | 28 ++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 crates/tower-http/RUSTSEC-0000-0000.md diff --git a/crates/tower-http/RUSTSEC-0000-0000.md b/crates/tower-http/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..bc05937 --- /dev/null +++ b/crates/tower-http/RUSTSEC-0000-0000.md @@ -0,0 +1,28 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "tower-http" +date = "2021-01-21" +url = "https://github.com/tower-rs/tower-http/pull/204" +categories = ["file-disclosure"] +keywords = ["directory traversal", "http"] + +[affected] +os = ["windows"] + +[versions] +patched = [">= 0.2.1"] +``` + +# Improper validation of Windows paths could lead to directory traversal attack + +`tower_http::services::fs::ServeDir` didn't correctly validate Windows paths +meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed +and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users +could potentially read files anywhere on the filesystem. + +This only impacts Windows. Linux and other unix likes are not impacted by this. + +See [tower-http#204] for more details. + +[tower-http#204]: https://github.com/tower-rs/tower-http/pull/204