crítica
CVE-2015-8747
The multifilesystem storage backend in Radicale before 1.1 allows remo ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
GHSA10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Ubuntu (media).
Descripción
The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | radicale | 1.1 |
| debian 11 | radicale | 1.1.1-1 |
| debian 12 | radicale | 1.1.1-1 |
| debian 13 | radicale | 1.1.1-1 |
| debian 14 | radicale | 1.1.1-1 |
| debian 7 | radicale | 0.7-1.1+deb7u1 |
| debian 8 | radicale | 0.9-1+deb8u1 |
| echo | radicale | 1.1.1-1 |
| ubuntu 15.04 | radicale | 0.9-1+deb8u1build0.15.04.1 |
Referencias
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175738.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175776.html
- http://www.debian.org/security/2016/dsa-3462
- http://www.openwall.com/lists/oss-security/2016/01/05/7
- http://www.openwall.com/lists/oss-security/2016/01/06/4
- http://www.openwall.com/lists/oss-security/2016/01/06/7
- http://www.securityfocus.com/bid/80255
- https://github.com/Kozea/Radicale
Las 15 referencias
- https://github.com/Kozea/Radicale/commit/18c88642fb19ee1480690e51fff9605ecc6fdab5
- https://github.com/Kozea/Radicale/pull/343
- https://github.com/Unrud/Radicale/commit/bcaf452e516c02c9bed584a73736431c5e8831f1
- https://github.com/pypa/advisory-database/tree/main/vulns/radicale/PYSEC-2016-36.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2015-8747
- https://web.archive.org/web/20200804235922/http://www.securityfocus.com/bid/80255
- https://www.cve.org/CVERecord?id=CVE-2015-8747