Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yNTI0LWMyZ2YtNWNocs2IuQ

Trac reStructuredText breach of privacy and denial of service vulnerability

Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. NOTE: this might be related to CVE-2006-3458.

Permalink: https://github.com/advisories/GHSA-r524-c2gf-5chr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yNTI0LWMyZ2YtNWNocs2IuQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: 19 days ago

Identifiers: GHSA-r524-c2gf-5chr, CVE-2006-3695
References:

• https://nvd.nist.gov/vuln/detail/CVE-2006-3695
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27706
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27708
• http://trac.edgewall.org/wiki/ChangeLog
• http://www.debian.org/security/2006/dsa-1152
• https://web.archive.org/web/20061227230548/http://trac.edgewall.org/wiki/ChangeLog
• https://web.archive.org/web/20140804165436/http://secunia.com/advisories/21534
• https://web.archive.org/web/20140806223337/http://secunia.com/advisories/20958
• https://web.archive.org/web/20200228034827/http://www.securityfocus.com/bid/18323
• https://github.com/advisories/GHSA-r524-c2gf-5chr

Blast Radius: 0.0

Affected Packages