CherryPy is vulnerable to a directory traversal that could allow attackers to read and write arbitrary files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-python/cherrypy | * | < 3.0.2-r1 | >= 2.2.1-r2 (revision), >= 3.0.2-r1 |
CherryPy is a Python-based, object-oriented web development framework.
CherryPy does not sanitize the session id, provided as a cookie value, in the FileSession._get_file_path() function before using it as part of the file name.
A remote attacker could exploit this vulnerability to read and possibly write arbitrary files on the web server, or to hijack valid sessions, by providing a specially crafted session id. This only affects applications using file-based sessions.
Disable the "FileSession" functionality by using "PostgresqlSession" or "RamSession" session management in your CherryPy application.
All CherryPy 2.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-python/cherrypy-2.2.1-r2"
All CherryPy 3.0 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-python/cherrypy-3.0.2-r1"
CherryPy is vulnerable to a directory traversal that could allow attackers to read arbitrary files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-python/cherrypy | * | < 2.1.1 | >= 2.1.1 |
CherryPy is a Python-based, object-oriented web development framework.
Ivo van der Wijk discovered that the "staticfilter" component of CherryPy fails to sanitize input correctly.
An attacker could exploit this flaw to obtain arbitrary files from the web server.
There is no known workaround at this time.
All CherryPy users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-python/cherrypy-2.1.1"