Cherokee is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles. Attackers can exploit this issue to execute arbitrary commands in a terminal. Cherokee 0.99.30 and prior are vulnerable.

Updates are available. Please see the references for details.

• http://www.alobbs.com/modules.php?op=modload&name=cherokee&file=index
• http://www.securityfocus.com/archive/1/508830
• http://www.securityfocus.com/bid/37715

---

Updated on 2015-03-25