MGASA-2021-0024 - Updated awstats package fixes a security vulnerability Publication date: 14 Jan 2021 URL: https://advisories.mageia.org/MGASA-2021-0024.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-29600 It was discovered that Awstats was vulnerable to path traversal attacks. A remote unauthenticated attacker could leverage that to perform arbitrary code execution. The previous fix did not fully address the issue when the default /etc/awstats/awstats.conf is not present (CVE-2020-29600). References: - https://bugs.mageia.org/show_bug.cgi?id=27920 - https://www.debian.org/lts/security/2020/dla-2506 - https://lists.fedoraproject.org/archives/list/[email protected]/thread/47QZWKSRZYZFESYTLSW7A6KVKOOPL7IV/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29600 SRPMS: - 7/core/awstats-7.7-1.1.mga7
Mageia 2021-0024: awstats security update
It was discovered that Awstats was vulnerable to path traversal attacks
Summary
CVE: CVE-2020-29600
It was discovered that Awstats was vulnerable to path traversal attacks. A
remote unauthenticated attacker could leverage that to perform arbitrary code
execution. The previous fix did not fully address the issue when the default
/etc/awstats/awstats.conf is not present (CVE-2020-29600).
Resolution
MGASA-2021-0024 - Updated awstats package fixes a security vulnerability
References
- https://bugs.mageia.org/show_bug.cgi?id=27920
- https://www.debian.org/lts/security/2020/dla-2506
- https://lists.fedoraproject.org/archives/list/[email protected]/thread/47QZWKSRZYZFESYTLSW7A6KVKOOPL7IV/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29600
Severity
Issued Date: 14 Jan 2021
URL: https://advisories.mageia.org/MGASA-2021-0024.html
Type: security
Affected Mageia releases: 7
News
HOWTOs
Features
Secure Linux Hosting for Businesses
What Is Threat Intelligence?
CloudLinux Simplifies & Enhances Linux Security with its TuxCare Unified Enterprise Support Services
LinuxSecurity, Leading Provider of Linux Security News and Information, Unveils its New Website
Biden’s New Executive Cybersecurity Order Highlights the Power of Open-Source Security
About Us
Powered By
