← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to retired/CVE-2017-15715

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
retired/CVE-2017-15715
1
 
PublicDateAtUSN: 2018-03-26
2
 
Candidate: CVE-2017-15715
3
 
PublicDate: 2018-03-26
4
 
References:
5
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15715
6
 
 http://www.openwall.com/lists/oss-security/2018/03/24/6
7
 
 https://httpd.apache.org/security/vulnerabilities_24.html
8
 
 https://usn.ubuntu.com/usn/usn-3627-1
9
 
 https://usn.ubuntu.com/usn/usn-3627-2
10
 
Description:
11
 
 In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch>
12
 
 could match '$' to a newline character in a malicious filename, rather than
13
 
 matching only the end of the filename. This could be exploited in
14
 
 environments where uploads of some files are are externally blocked, but
15
 
 only by matching the trailing portion of the filename.
16
 
Ubuntu-Description:
17
 
Notes:
18
 
Bugs:
19
 
Priority: low
20
 
Discovered-by: Elar Lang
21
 
Assigned-to: mdeslaur
22
 
 
23
 
 
24
 
Patches_apache2:
25
 
 upstream: https://svn.apache.org/viewvc?view=revision&revision=1824339
26
 
 upstream: https://svn.apache.org/viewvc?view=revision&revision=1824439
27
 
 upstream: https://svn.apache.org/viewvc?view=revision&revision=1824472 (2.4)
28
 
upstream_apache2: released (2.4.30)
29
 
precise/esm_apache2: not-affected
30
 
trusty_apache2: released (2.4.7-1ubuntu4.20)
31
 
xenial_apache2: released (2.4.18-2ubuntu3.8)
32
 
artful_apache2: released (2.4.27-2ubuntu4.1)
33
 
bionic_apache2: released (2.4.29-1ubuntu4.1)
34
 
devel_apache2: released (2.4.29-1ubuntu4.1)