CherryPy: Directory traversal vulnerability

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
dev-python/cherrypy	< 2.1.1	>= 2.1.1	All supported architectures

Related bugreports: #134273

CherryPy is vulnerable to a directory traversal that could allow attackers to read arbitrary files.

2. Impact Information

CherryPy is a Python-based, object-oriented web development framework.

Ivo van der Wijk discovered that the "staticfilter" component of CherryPy fails to sanitize input correctly.

An attacker could exploit this flaw to obtain arbitrary files from the web server.

3. Resolution Information

There is no known workaround at this time.

All CherryPy users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-python/cherrypy-2.1.1"

4. References

Updated May 30, 2006

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.