Описание
hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack
Path resolution in hyper-staticfile didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
Пакеты
Наименование
hyper-staticfile
rust
Затронутые версииВерсия исправления
< 0.9.2
0.9.2
Наименование
hyper-staticfile
rust
Затронутые версииВерсия исправления
= 0.10.0-alpha.1
0.10.0-alpha.2
Дефекты
CWE-22
Дефекты
CWE-22