CVE-2018-19052
Fixed in a distro release EPSS 14%
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
Products: lighttpd, opensuse backports_sle, opensuse leap, suse_linux_enterprise_server, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | lighttpd | 1.4.52-1 |
| Debian 13 | lighttpd | 1.4.52-1 |
| Debian 14 | lighttpd | 1.4.52-1 |
| Debian 9 | lighttpd | 1.4.45-1+deb9u1 |
| SUSE Package Hub 15 | lighttpd | 1.4.54-bp151.4.3.1 |
| SUSE Package Hub 15 SP1 | lighttpd | 1.4.54-bp151.4.3.1 |
| Ubuntu Pro 14.04 LTS | lighttpd | 1.4.33-1+nmu2ubuntu2.1+esm1 |
| Ubuntu Pro 16.04 LTS | lighttpd | 1.4.35-4ubuntu2.1+esm1 |
| Ubuntu Pro 18.04 LTS | lighttpd | 1.4.45-1ubuntu3.18.04.1+esm1 |
| openSUSE Leap 15.0 | lighttpd | 1.4.54-bp151.4.3.1 |
| openSUSE Leap 15.1 | lighttpd | 1.4.54-bp151.4.3.1 |
| openSUSE Tumbleweed | lighttpd | 1.4.59-2.1 |