Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines
Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.
REPEAT: Do NOT report bugs for outdated packages!
https://wiki.archlinux.org/title/Bug_reporting_guidelines
Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.
REPEAT: Do NOT report bugs for outdated packages!
FS#69301 - [awstats] [Security] information disclosure (CVE-2020-35176)
Attached to Project:
Community Packages
Opened by Jonas Witschel (diabonas) - Tuesday, 12 January 2021, 09:22 GMT
Last edited by Jonas Witschel (diabonas) - Thursday, 18 March 2021, 11:51 GMT
Opened by Jonas Witschel (diabonas) - Tuesday, 12 January 2021, 09:22 GMT
Last edited by Jonas Witschel (diabonas) - Thursday, 18 March 2021, 11:51 GMT
|
DetailsSummary
======= The package awstats is vulnerable to information disclosure via CVE-2020-35176. Guidance ======== A fix is proposed in pull request #196 referenced below. Since upstream has not shown any signs of activity at all in the last month and the severity of this issue is relatively high, I suggest going with the proposed patch. References ========== https://security.archlinux.org/AVG-1356 https://github.com/eldy/awstats/issues/195 https://github.com/eldy/awstats/pull/196 |
This task depends upon
Closed by Jonas Witschel (diabonas)
Thursday, 18 March 2021, 11:51 GMT
Reason for closing: Fixed
Additional comments about closing: awstats 7.8-3
Thursday, 18 March 2021, 11:51 GMT
Reason for closing: Fixed
Additional comments about closing: awstats 7.8-3
Comment by Jonas Witschel (diabonas) -
Monday, 18 January 2021, 14:31 GMT
The pull request fixing the issue has now been merged into the upstream development branch.