Redhat » Enterprise Linux Server : Security Vulnerabilities, CVEs, (Directory traversal) CVSS score >= 9
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
Max CVSS
9.1
EPSS Score
0.46%
Published
2019-03-23
Updated
2022-06-30
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.
Max CVSS
9.3
EPSS Score
0.69%
Published
2018-08-01
Updated
2023-02-13
2 vulnerabilities found