MGASA-2018-0196

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2018-0196.html
Import Source
https://advisories.mageia.org/MGASA-2018-0196.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2018-0196
Published
2018-04-06T22:54:47Z
Modified
2026-04-16T04:26:56.390511Z
Summary
Updated nmap packages fix security vulnerability
Details

Nmap developer nnposter found a security flaw (directory traversal vulnerability) in the way the non-default http-fetch script sanitized URLs. If a user manualy ran this NSE script against a malicious web server, the server could potentially (depending on NSE arguments used) cause files to be saved outside the intended destination directory. Existing files couldn't be overwritten. We fixed http-fetch, audited our other scripts to ensure they didn't make this mistake, and updated the httpspider library API to protect against this by default.

References
Credits

Affected packages

Mageia:6 / nmap

Package

Name
nmap
Purl
pkg:rpm/mageia/nmap?arch=source&distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.40-1.1.mga6

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2018-0196.json"