CVE-2019-20800

CVE-2019-20800 affects Cherokee up to version 1.2.104. A remote attacker can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair (handler_cgi.c) by sending a large number of request headers, as shown by a GET with many Host: 127.0.0.1 headers. Documents confirm the flaw exists acr...

CVE-2020-12845

Cherokee CVE-2020-12845: versions 0.4.27–1.2.104 are affected by a denial-of-service caused by a NULL-pointer dereference when handling a malformed Authorization header during cherokee_validator_parse_basic/digest. This allows remote unauthenticated attackers to crash the server. Mitigation: upda...

CVE-2019-20798

CVE-2019-20798 affects Cherokee web server versions 1.2.104 and earlier. The issue is an XSS in the handler_server_info.c module that causes the About page to display the requested URL incorrectly in the default configuration, enabling an attacker in the administrator panel to reconfigure the ser...

CVE-2019-20799

Summary of CVE-2019-20799 (Cherokee) : Cherokee web server up to version 1.2.104 has multiple memory corruption vulnerabilities that can be exploited remotely to destabilize the server. Affected component is the Cherokee web server itself; the root cause is memory corruption within the server pro...

CVE-2014-4668

CVE-2014-4668 affects Cherokee 1.2.103 and earlier when using LDAP: the cherokee_validator_ldap_check function does not properly handle unauthenticated-bind semantics, allowing authentication bypass via an empty password. Connected advisories confirm that updates were released across multiple dis...

CVE-2011-2190

The Cherokee generate_admin_password function (before version 1.2.99) seeds its RNG with time and PID values, enabling a local-user brute-force approach to determine admin passwords. Affected: Cherokee before 1.2.99. Impact: weak randomness in password generation increases the risk of unauthorize...

CVE-2009-4489

CVE-2009-4489 (Cherokee) : Cherokee 0.99.32 and earlier fails to sanitize non‑printable characters in log files, allowing an HTTP request with escape sequences to modify a window title or potentially execute commands/overwrite files. The issue is a log‑escape vulnerability affecting Cherokee and ...

CVE-2011-2191

CVE-2011-2191 affects Cherokee admin in Cherokee prior to 1.2.99. The vulnerability is a cross-site request forgery (CSRF) that can hijack an administrator’s session to perform actions that insert cross-site scripting (XSS) sequences, demonstrated via a crafted nickname in vserver/apply. Impact d...