ClearOS Documentation

×

Warning

301 error for file:https://clearos.com/dokuwiki2/lib/exe/css.php?t=dokuwiki&tseed=82873f9c9a1f5784b951644363f20ef8

User Tools

Site Tools


CVE 2017-15715

'In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.'

ClearCenter response

Short response

The '' parameter specified by this vulnerability is NOT enabled by default in ClearOS. Further, this parameter is not tunable to be made available via ClearOS' Webconfig. If you have manually turned this parameter on, disable it.

Long response

The '' parameter specified by this vulnerability is NOT enabled by default in ClearOS. Further, this parameter is not tunable to be made available via ClearOS' Webconfig nor does any app in the ClearOS Marketplace require that this parameter be enabled. Users of ClearOS' Webconfig or ClearOS' Web Server would have to be enabled by the user in command line. If you are using custom code that has required you to manipulate this value, please disable it.

Resolution

If you have enabled '' through custom editing of ClearOS via command line, disable it.

content/en_us/announcements_cve_cve-2017-15715.txt · Last modified: 2018/09/28 10:21 by dloper

https://clearos.com/dokuwiki2/lib/exe/indexer.php?id=content%3Aen_us%3Aannouncements_cve_cve-2017-15715&1558895226