UbuntuUpdates.org

Package "uwsgi-src"

Name: uwsgi-src

Description:

sources for uWSGI plugins
Latest version: 2.0.12-5ubuntu3.2
Release: xenial (16.04)
Level: security
Repository: universe
Head package: uwsgi
Homepage: http://projects.unbit.it/uwsgi/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "uwsgi-src"

All arch deb package
APT INSTALL

Other versions of "uwsgi-src" in Xenial

Repository Area Version
base universe 2.0.12-5ubuntu3
updates universe 2.0.12-5ubuntu3.2

Changelog

Version: 2.0.12-5ubuntu3.2 2018-10-01 14:06:50 UTC

  uwsgi (2.0.12-5ubuntu3.2) xenial-security; urgency=medium

  * SECURITY UPDATE: Directory traversal
    - debian/patches/CVE-2018-7490.patch: enforce php default document_root
      behaviour, to not show external files
    - CVE-2018-7490
  * SECURITY UPDATE: Stack buffer overflow in uwsgi_expand_path()
    - debian/patches/CVE-2018-6758.patch: improve uwsgi_expand_path() to
      sanitize input, avoiding stack corruption and potential security issue
    - CVE-2018-6758

 -- Mike Salvatore <email address hidden> Thu, 27 Sep 2018 13:52:41 -0400
CVE-2018-7490 uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
CVE-2018-6758 The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.


About   -   Send Feedback to @ubuntu_updates