Nostromo nhttpd

What it is

Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor notices and references

• www.nazgul.ch/dev/nostromo_cl.txt
• nvd.nist.gov/vuln/detail/CVE-2019-16278

Description and required action as published by CISA. Full record at NVD.