[ASA-202009-14] yaws: multiple issues

[Morten Linderud]

Arch Linux Security Advisory ASA-202009-14
==========================================

Severity: High
Date    : 2020-09-26
CVE-ID  : CVE-2020-12872 CVE-2020-24379 CVE-2020-24916
Package : yaws
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1228

Summary
=======

The package yaws before version 2.0.8-1 is vulnerable to multiple
issues including arbitrary command execution and information
disclosure.

Resolution
==========

Upgrade to 2.0.8-1.

# pacman -Syu "yaws>=2.0.8-1"

The problems have been fixed upstream in version 2.0.8.

Workaround
==========

None.

Description
===========

- CVE-2020-12872 (information disclosure)

yaws_config.erl in Yaws through 2.0.7 loads obsolete TLS ciphers, as
demonstrated by ones that allow Sweet32 attacks.

- CVE-2020-24379 (information disclosure)

WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is
vulnerable to XXE injection.

- CVE-2020-24916 (arbitrary command execution)

CGI implementation in Yaws web server versions 1.81 to 2.0.7 is
vulnerable to OS command injection.

Impact
======

A remote attacker might be able to execute arbitrary commands,
downgrade TLS ciphers, or load foreign entities via crafted content.

References
==========

https://github.com/erlyaws/yaws/releases/tag/yaws-2.0.8
https://vuln.be/post/yaws-xxe-and-shell-injections/
https://sweet32.info/
https://medium.com/@charlielabs101/cve-2020-12872-df315411aa70
https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html
https://github.com/erlyaws/yaws/commit/05a06345012598f5da55dbb4d041c8dc26e88e6c
https://github.com/vulnbe/poc-yaws-dav-xxe
https://github.com/erlyaws/yaws/commit/799b3b526d15b7a9bc43ae97165aeb085f18fac1
https://github.com/vulnbe/poc-yaws-cgi-shell-injection
https://security.archlinux.org/CVE-2020-12872
https://security.archlinux.org/CVE-2020-24379
https://security.archlinux.org/CVE-2020-24916
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20201006/a69865aa/attachment.sig>