Re: CVE Request: click

[Jamie Strandboge <jamie () canonical com>]

I forgot to CC cve-assign () mitre org on the initial request so bringing them in
the loop now.


On 01/11/2016 11:42 AM, Jamie Strandboge wrote:
> Hi MITRE, all,
>
> A vulnerability was discovered in the click package system:
> https://launchpad.net/bugs/1506467
> http://www.ubuntu.com/usn/usn-2771-1/
>
> It was fixed in 0.4.42 with:
> https://code.launchpad.net/~cjwatson/click/audit-missing-dot-slash/+merge/274554
>
> This is an input sanitization bug where click assumed leading paths were always
> prefixed with './' which, for example, allows a crafted click to ship a '.click'
> directory to manipulate the click install process.
>
> Can we get a CVE for this?
>
> Thanks!


-- 
Jamie Strandboge                 http://www.ubuntu.com/

Attachment: signature.asc
Description: OpenPGP digital signature