CVE Request for read-only directory traversal in Etherpad Minify

[Jeremy Stanley <fungi () yuggoth org>]

A vulnerability was discovered in Etherpad (see below). In order to
ensure full traceability, we need a CVE number assigned that we can
attach to further notifications. This issue is already public.

Title: Read-only directory traversal in Etherpad Minify
Reporter: Tom Hunkapiller
Versions: 1.1.2 through 1.5.2

Description:
Tom Hunkapiller reported a vulnerability in the minify feature of
current Etherpad releases. Backslashes are replaced with slashes in
the path parameter of HTTP API calls after path normalization is
applied, allowing an attacker supplying specially-crafted requests
to remotely read arbitrary files on the server's filesystem with the
privileges of the account running the service.

Notes:
This bug was introduced in commit a97b83b which was initially
included in the 1.1.2 release, and is fixed in commit 9d4e5f6 which
will appear in a future 1.5.3 release.

References:
https://github.com/ether/etherpad-lite/commit/9d4e5f6

-- 
Jeremy Stanley

Attachment: signature.asc
Description: Digital signature