CVE-2019-17640

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-17640
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-17640
Aliases
Published
2020-10-15T21:15:11Z
Modified
2026-10-24T10:50:35Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.

References

Affected packages

Git
github.com/eclipse-vertx/vert.x

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-vertx/vert.x
Events
Introduced
05683b353b8ad53d28e9a70f0f0bfc2ce36c083c
Last Affected
d4490fed7871b55c3cefa459f622fb22cfead951
Introduced
3daea80a20324bb19e97c8455c648efa62fba104
Last Affected
95372a1f8a7ea235415ce746eda91e0243a59307
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "last_affected": "3.9.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-beta1"
                },
                {
                    "last_affected": "4.0.0-beta1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-beta2"
                },
                {
                    "last_affected": "4.0.0-beta2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-beta3"
                },
                {
                    "last_affected": "4.0.0-beta3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone1"
                },
                {
                    "last_affected": "4.0.0-milestone1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone2"
                },
                {
                    "last_affected": "4.0.0-milestone2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone3"
                },
                {
                    "last_affected": "4.0.0-milestone3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone4"
                },
                {
                    "last_affected": "4.0.0-milestone4"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone5"
                },
                {
                    "last_affected": "4.0.0-milestone5"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

3.*
3.4.0
3.4.1
3.4.2
3.5.0
3.5.0.Beta1
3.5.1
3.6.0
3.6.0.CR1
3.6.0.CR2
3.6.1
3.6.2
3.6.3
3.7.0
3.7.1
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
4.*
4.0.0-beta1
4.0.0-beta2
4.0.0-beta3
4.0.0-milestone1
4.0.0-milestone2
4.0.0-milestone3
4.0.0-milestone4
4.0.0-milestone5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json"
github.com/eclipse-vertx/vertx-sql-client

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-vertx/vertx-sql-client
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
df20a720ec8d3b50e8b4ca47869d0e1c8cf31a8a
Introduced
b6b141720e1f8150d90df89d4f49d7bbbe848af4
Last Affected
27fe6ddb558ce3a8acf2782d8531f671ef2d4ddb
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "last_affected": "3.9.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-beta1"
                },
                {
                    "last_affected": "4.0.0-beta1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-beta2"
                },
                {
                    "last_affected": "4.0.0-beta2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-beta3"
                },
                {
                    "last_affected": "4.0.0-beta3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone1"
                },
                {
                    "last_affected": "4.0.0-milestone1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone2"
                },
                {
                    "last_affected": "4.0.0-milestone2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone3"
                },
                {
                    "last_affected": "4.0.0-milestone3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone4"
                },
                {
                    "last_affected": "4.0.0-milestone4"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone5"
                },
                {
                    "last_affected": "4.0.0-milestone5"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

3.*
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
4.*
4.0.0-beta1
4.0.0-beta2
4.0.0-beta3
4.0.0-milestone1
4.0.0-milestone2
4.0.0-milestone3
4.0.0-milestone4
4.0.0-milestone5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json"
github.com/vert-x3/vertx-web

Affected ranges

Type
GIT
Repo
https://github.com/vert-x3/vertx-web
Events
Introduced
8a11acc912accf4c0661f5c56f1cd387f5200718
Last Affected
1258a682e0ec6a695da8b05063afb0ee57a503c9
Introduced
4b8bd2f1053800a3e79152f2f10026942554a44f
Last Affected
2e72faef41bec6162023aca898678929064870cd
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "last_affected": "3.9.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-beta1"
                },
                {
                    "last_affected": "4.0.0-beta1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-beta2"
                },
                {
                    "last_affected": "4.0.0-beta2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-beta3"
                },
                {
                    "last_affected": "4.0.0-beta3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone1"
                },
                {
                    "last_affected": "4.0.0-milestone1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone2"
                },
                {
                    "last_affected": "4.0.0-milestone2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone3"
                },
                {
                    "last_affected": "4.0.0-milestone3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone4"
                },
                {
                    "last_affected": "4.0.0-milestone4"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0-milestone5"
                },
                {
                    "last_affected": "4.0.0-milestone5"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

3.*
3.4.0
3.4.1
3.4.2
3.5.0
3.5.1
3.6.0
3.6.0.CR1
3.6.0.CR2
3.6.1
3.6.2
3.6.3
3.7.0
3.7.1
3.8.0
3.8.1
3.8.2
3.8.3
3.8.3-01
3.8.4
3.8.5
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
4.*
4.0.0-beta1
4.0.0-beta2
4.0.0-beta3
4.0.0-milestone1
4.0.0-milestone2
4.0.0-milestone3
4.0.0-milestone4
4.0.0-milestone5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json"