MapServer Security Advisory: CVE-2020-33721, CVE-2020-59431 and Fix Guidance

Vulnerability Summary 1. Vulnerability Overview CVE-2020-33721: A security flaw exists in the MapServer SLD (Styled Layer Descriptor) parser. CVE-2020-59431: A security flaw exists in the OGR WFS (Web Feature Service) filters within MapServer. Other Vulnerabilities: Security vulnerabilities related to expression functions used for testing. 2. Scope of Impact CVE-2020-33721: Affects all versions. The advisory states that security support for the 7.6 branch has ended, and the 8.4, 8.2, and 8.0 branches are no longer supported. CVE-2020-59431: Affects all versions. The advisory states that security support for the 7.6 branch has ended, and the 8.2 and 8.0 branches are no longer supported. Expression Function Vulnerabilities: Affects MapServer 8.2 and 7.6 series versions. 3. Remediation For CVE-2020-33721: It is strongly recommended that all users upgrade to MapServer version 8.6.1. For CVE-2020-59431: It is strongly recommended that all users upgrade to MapServer version 8.4.1. For Expression Function Vulnerabilities: It is recommended to upgrade to MapServer version 8.2.1 or 7.6.7. Users should obtain updated copies from the "Download" page and refer to the "Migration Guide" for upgrade instructions. 4. POC/Exploit Code The provided screenshot does not contain specific POC or exploit code; it only provides links to the and for reference.

Goal Reached Thanks to every supporter — we hit 100%!

MapServer Security Advisory: CVE-2020-33721, CVE-2020-59431 and Fix Guidance