CVE-2018-7490
uwsgi-plugin-python: uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory trave...
CVE-2018-7490 is fixed in 44 products on 1 platform, first by libapache2-mod-proxy-uwsgi 2.0.15-10.2ubuntu2.1, released February 26, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.6942
99th percentile
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libapache2-mod-proxy-uwsgi · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | libapache2-mod-proxy-uwsgi 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| libapache2-mod-ruwsgi · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | libapache2-mod-ruwsgi 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| libapache2-mod-uwsgi · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | libapache2-mod-uwsgi 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| python-uwsgidecorators · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | python-uwsgidecorators 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| python3-uwsgidecorators · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | python3-uwsgidecorators 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-app-integration-plugins · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-app-integration-plugins 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-core · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-core 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-emperor · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-emperor 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-extra · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-extra 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-infrastructure-plugins · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-infrastructure-plugins 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-alarm-curl · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-alarm-curl 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-alarm-xmpp · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-alarm-xmpp 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-asyncio-python · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-asyncio-python 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-asyncio-python3 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-asyncio-python3 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-curl-cron · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-curl-cron 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-emperor-pg · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-emperor-pg 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-fiber · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-fiber 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-gccgo · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-gccgo 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-geoip · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-geoip 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-gevent-python · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-gevent-python 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-glusterfs · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-glusterfs 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-graylog2 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-graylog2 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-greenlet-python · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-greenlet-python 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-jvm-openjdk-8 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-jvm-openjdk-8 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-jwsgi-openjdk-8 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-jwsgi-openjdk-8 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-ldap · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-ldap 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-lua5.1 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-lua5.1 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-lua5.2 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-lua5.2 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-mono · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-mono 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-psgi · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-psgi 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-python · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-python 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-python3 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-python3 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-rack-ruby2.5 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-rack-ruby2.5 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-rados · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-rados 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-rbthreads · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-rbthreads 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-ring-openjdk-8 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-ring-openjdk-8 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-router-access · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-router-access 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-servlet-openjdk-8 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-servlet-openjdk-8 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-sqlite3 · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-sqlite3 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-tornado-python · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-tornado-python 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugin-xslt · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugin-xslt 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-plugins-all · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-plugins-all 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |
| uwsgi-src · Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | uwsgi-src 2.0.15-10.2ubuntu2.1 | Feb 26, 2018 |