This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============5248321678472257730==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="oNakZL7sz9o5lJLxWBjVML6JIWkVQjfxp"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--oNakZL7sz9o5lJLxWBjVML6JIWkVQjfxp
Content-Type: multipart/mixed;
 boundary="fu4j0zAPhJ0joEzjD802WLGv9PwAPoPDL";
 protected-headers="v1"
From: Avital Ostromich <avital.ostromich@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <e5d974d9-8b00-428e-706f-4e063f0e9003@canonical.com>
Subject: [USN-4953-1] AWStats vulnerabilities

--fu4j0zAPhJ0joEzjD802WLGv9PwAPoPDL
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: base64
Content-Language: en-US



==========================================================================
Ubuntu Security Notice USN-4953-1
May 13, 2021

awstats vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM

Summary:

Several security issues were fixed in AWStats.

Software Description:
- awstats: powerful and featureful web server log analyzer

Details:

Sean Boran discovered that AWStats incorrectly filtered certain parameters.
A remote attacker could possibly use this issue to execute arbitrary code.
(CVE-2020-29600)

It was discovered that AWStats incorrectly filtered certain parameters. A
remote attacker could possibly use this issue to access sensitive
information. (CVE-2020-35176)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  awstats                         7.6+dfsg-2ubuntu0.20.10.1

Ubuntu 20.04 LTS:
  awstats                         7.6+dfsg-2ubuntu0.20.04.1

Ubuntu 18.04 LTS:
  awstats                         7.6+dfsg-2ubuntu0.18.04.1

Ubuntu 16.04 ESM:
  awstats                         7.4+dfsg-1ubuntu0.4+esm1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-4953-1
  CVE-2017-1000501, CVE-2020-29600, CVE-2020-35176

Package Information:
  https://launchpad.net/ubuntu/+source/awstats/7.6+dfsg-2ubuntu0.20.10.1
  https://launchpad.net/ubuntu/+source/awstats/7.6+dfsg-2ubuntu0.20.04.1
  https://launchpad.net/ubuntu/+source/awstats/7.6+dfsg-2ubuntu0.18.04.1