ArchLinux: 202103-15: awstats: directory traversal
Summary
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. This issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.
Resolution
Upgrade to 7.8-3.
# pacman -Syu "awstats>=7.8-3"
The problem has been fixed upstream but no release is available yet.
References
https://bugs.archlinux.org/task/69301 https://github.com/eldy/awstats/issues/195 https://github.com/eldy/awstats/pull/196 https://github.com/eldy/AWStats/commit/0d4d4c05f8e73be8f71dd361dc55cbd52858b823 https://security.archlinux.org/CVE-2020-35176
Workaround
None.