Description (CNA)
In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenBSD / OpenBSD | affected 7.5 before 7.5 errata 009; affected 7.4 before 7.4 errata 022; unaffected 7.5 errata 009; unaffected 7.4 errata 022 |
CWE
CWE-22
References
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/022_readdir.patch.sig
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/009_readdir.patch.sig
ADP enrichment
No English description supplied.
No references supplied.