{
  "cveId": "CVE-2018-7490",
  "url": "https://patchblox.com/security/cve/CVE-2018-7490",
  "summary": "CVE-2018-7490 is fixed in 44 products on 1 platform, first by libapache2-mod-proxy-uwsgi 2.0.15-10.2ubuntu2.1, released February 26, 2018. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "uwsgi-plugin-python: uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory trave...",
  "description": "uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.",
  "published": "2018-02-26T14:29:00Z",
  "severity": "Medium",
  "epss": 0.69423,
  "epssPercentile": 0.99364,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libapache2-mod-proxy-uwsgi",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "libapache2-mod-proxy-uwsgi 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libapache2-mod-proxy-uwsgi-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "libapache2-mod-ruwsgi",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "libapache2-mod-ruwsgi 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libapache2-mod-ruwsgi-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "libapache2-mod-uwsgi",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "libapache2-mod-uwsgi 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libapache2-mod-uwsgi-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "python-uwsgidecorators",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "python-uwsgidecorators 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-uwsgidecorators-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-uwsgidecorators",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "python3-uwsgidecorators 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python3-uwsgidecorators-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-app-integration-plugins",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-app-integration-plugins 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-app-integration-plugins-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-core",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-core 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-core-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-emperor",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-emperor 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-emperor-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-extra",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-extra 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-extra-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-infrastructure-plugins",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-infrastructure-plugins 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-infrastructure-plugins-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-alarm-curl",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-alarm-curl 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-alarm-curl-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-alarm-xmpp",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-alarm-xmpp 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-alarm-xmpp-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-asyncio-python",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-asyncio-python 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-asyncio-python-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-asyncio-python3",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-asyncio-python3 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-asyncio-python3-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-curl-cron",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-curl-cron 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-curl-cron-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-emperor-pg",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-emperor-pg 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-emperor-pg-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-fiber",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-fiber 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-fiber-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-gccgo",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-gccgo 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-gccgo-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-geoip",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-geoip 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-geoip-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-gevent-python",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-gevent-python 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-gevent-python-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-glusterfs",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-glusterfs 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-glusterfs-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-graylog2",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-graylog2 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-graylog2-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-greenlet-python",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-greenlet-python 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-greenlet-python-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-jvm-openjdk-8",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-jvm-openjdk-8 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-jvm-openjdk-8-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-jwsgi-openjdk-8",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-jwsgi-openjdk-8 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-jwsgi-openjdk-8-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-ldap",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-ldap 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-ldap-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-lua5.1",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-lua5.1 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-lua5.1-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-lua5.2",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-lua5.2 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-lua5.2-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-mono",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-mono 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-mono-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-psgi",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-psgi 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-psgi-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-python",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-python 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-python-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-python3",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-python3 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-python3-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-rack-ruby2.5",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-rack-ruby2.5 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-rack-ruby2.5-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-rados",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-rados 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-rados-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-rbthreads",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-rbthreads 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-rbthreads-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-ring-openjdk-8",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-ring-openjdk-8 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-ring-openjdk-8-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-router-access",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-router-access 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-router-access-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-servlet-openjdk-8",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-servlet-openjdk-8 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-servlet-openjdk-8-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-sqlite3",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-sqlite3 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-sqlite3-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-tornado-python",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-tornado-python 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-tornado-python-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugin-xslt",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugin-xslt 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugin-xslt-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-plugins-all",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-plugins-all 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-plugins-all-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    },
    {
      "platform": "linux",
      "product": "uwsgi-src",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.0.15-10.2ubuntu2.1",
      "fix": "uwsgi-src 2.0.15-10.2ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-uwsgi-src-2.0.15-10.2ubuntu2.1",
      "released": "2018-02-26T14:29:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T06:34:28Z"
}