Arch Linux Security Advisory ASA-202009-14 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-12872 CVE-2020-24379 CVE-2020-24916 Package : yaws Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1228 Summary ======= The package yaws before version 2.0.8-1 is vulnerable to multiple issues including arbitrary command execution and information disclosure. Resolution ========== Upgrade to 2.0.8-1. # pacman -Syu "yaws>=2.0.8-1" The problems have been fixed upstream in version 2.0.8. Workaround ========== None. Description =========== - CVE-2020-12872 (information disclosure) yaws_config.erl in Yaws through 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks. - CVE-2020-24379 (information disclosure) WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. - CVE-2020-24916 (arbitrary command execution) CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection. Impact ====== A remote attacker might be able to execute arbitrary commands, downgrade TLS ciphers, or load foreign entities via crafted content. References ========== https://github.com/erlyaws/yaws/releases/tag/yaws-2.0.8 https://vuln.be/post/yaws-xxe-and-shell-injections/ https://sweet32.info/ https://medium.com/@charlielabs101/cve-2020-12872-df315411aa70 https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Comman... https://github.com/erlyaws/yaws/commit/05a06345012598f5da55dbb4d041c8dc26e88... https://github.com/vulnbe/poc-yaws-dav-xxe https://github.com/erlyaws/yaws/commit/799b3b526d15b7a9bc43ae97165aeb085f18f... https://github.com/vulnbe/poc-yaws-cgi-shell-injection https://security.archlinux.org/CVE-2020-12872 https://security.archlinux.org/CVE-2020-24379 https://security.archlinux.org/CVE-2020-24916