kritisch
CVE-2015-8747
The multifilesystem storage backend in Radicale before 1.1 allows remo ...
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
GHSA10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Ubuntu (mittel).
Beschreibung
The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | radicale | 1.1 |
| debian 11 | radicale | 1.1.1-1 |
| debian 12 | radicale | 1.1.1-1 |
| debian 13 | radicale | 1.1.1-1 |
| debian 14 | radicale | 1.1.1-1 |
| debian 7 | radicale | 0.7-1.1+deb7u1 |
| debian 8 | radicale | 0.9-1+deb8u1 |
| echo | radicale | 1.1.1-1 |
| ubuntu 15.04 | radicale | 0.9-1+deb8u1build0.15.04.1 |
Referenzen
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175738.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175776.html
- http://www.debian.org/security/2016/dsa-3462
- http://www.openwall.com/lists/oss-security/2016/01/05/7
- http://www.openwall.com/lists/oss-security/2016/01/06/4
- http://www.openwall.com/lists/oss-security/2016/01/06/7
- http://www.securityfocus.com/bid/80255
- https://github.com/Kozea/Radicale
Alle 15 Referenzen
- https://github.com/Kozea/Radicale/commit/18c88642fb19ee1480690e51fff9605ecc6fdab5
- https://github.com/Kozea/Radicale/pull/343
- https://github.com/Unrud/Radicale/commit/bcaf452e516c02c9bed584a73736431c5e8831f1
- https://github.com/pypa/advisory-database/tree/main/vulns/radicale/PYSEC-2016-36.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2015-8747
- https://web.archive.org/web/20200804235922/http://www.securityfocus.com/bid/80255
- https://www.cve.org/CVERecord?id=CVE-2015-8747