CVE-2021-32062
Publication date 6 May 2021
Last updated 11 July 2025
Ubuntu priority
Description
MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI).
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| mapserver | 26.04 LTS resolute |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty | Not in release |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.3 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
Other references
- https://github.com/mapserver/mapserver/issues/6313
- https://github.com/MapServer/MapServer/pull/6314
- https://github.com/mapserver/mapserver/commit/927ac97cb9ece305306b5ab2b5600d3afe8c1732 (branch-7-6)
- https://github.com/mapserver/mapserver/commit/7db7cbb26b6bc6e651db268e9536836a56e6825a (branch-7-2)
- https://github.com/mapserver/mapserver/commit/82a3eb5f6c8f75cedd095b909cc4990f3d8a99e1 (branch-7-0)
- https://mapserver.org/development/changelog/changelog-7-6.html
- https://mapserver.org/development/changelog/changelog-7-0.html
- https://mapserver.org/development/changelog/changelog-7-4.html
- https://mapserver.org/development/changelog/changelog-7-2.html
- https://www.cve.org/CVERecord?id=CVE-2021-32062