UbuntuUpdates.org

Package "yaws"

Name: yaws

Description:

High performance HTTP 1.1 webserver written in Erlang
Latest version: 2.0.4+dfsg-2ubuntu0.1
Release: bionic (18.04)
Level: security
Repository: universe
Homepage: http://yaws.hyber.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "yaws"

All arch deb package
APT INSTALL

Other versions of "yaws" in Bionic

Repository Area Version
base universe 2.0.4+dfsg-2
updates universe 2.0.4+dfsg-2ubuntu0.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2.0.4+dfsg-2ubuntu0.1 2020-10-05 14:06:17 UTC

  yaws (2.0.4+dfsg-2ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: XXE injection
    - debian/patches/CVE-2020-24379.patch: Reject external entities in DAV
      requests
    - CVE-2020-24379
  * SECURITY UPDATE: OS command injection
    - debian/patches/CVE-2020-24916.patch: Sanitize CGI requests
    - CVE-2020-24916

 -- Mike Salvatore <email address hidden> Thu, 01 Oct 2020 08:49:36 -0400
CVE-2020-24379 WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
CVE-2020-24916 CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.


About   -   Send Feedback to @ubuntu_updates