CVE-2024-10933
4.1
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Summary
In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| OpenBSD | OpenBSD | 7.5 < 7.5 errata 009 | affected |
| OpenBSD | OpenBSD | 7.4 < 7.4 errata 022 | affected |
| OpenBSD | OpenBSD | 7.5 errata 009 | unaffected |
| OpenBSD | OpenBSD | 7.4 errata 022 | unaffected |
Weaknesses
- CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/022_readdir.patch.sig
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/009_readdir.patch.sig
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.