CVE:CVE-2018-19052
CNNVD:CNNVD-201811-129
lighttpd是德国软件开发者Jan Kneschke所研发的一款开源的Web服务器，它的主要特点是仅需少量的内存及CPU资源即可达到同类网页服务器的性能。
lighttpd 1.4.50之前的版本中的mod_alias.c文件的‘mod_alias_physical_handler’函数存在路径遍历漏洞。远程攻击者可利用该漏洞访问文件。
solution:Upgrade lighttpd lighttpd to a higher version than 1.4.50,and avoid the version (,1.4.50); Upgrade opensuse backports_sle to a higher version than 15.0,15.0:sp1,and avoid the version 15.0,15.0:sp1; Upgrade opensuse leap to a higher version than 15.0,15.1,and avoid the version 15.0,15.1; Upgrade suse suse_linux_enterprise_server to a higher version than 11:sp3,11:sp4,12,12:sp1,12:sp2,12:sp3,12:sp4,and avoid the version 11:sp3,11:sp4,12,12:sp1,12:sp2,12:sp3,12:sp4; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0