Bug 1724989 (CVE-2019-10185)

Summary: CVE-2019-10185 icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: cbuissar, dbhole, jvanek, omajid, security-response-team, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
It was found that icedtea-web was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-31 19:18:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1725945, 1725946, 1725947, 1725948, 1732552, 1734804    
Bug Blocks: 1724963    

Description Marian Rehak 2019-06-28 08:24:23 UTC
The nested jar auto-extraction feature is vulnerable to "zip-slip" attacks, resulting in directory traversal. 

A specially crafted JAR file could use this flaw to write and overwrite arbitrary files. Combined with CVE-2019-10181, it can be used to rewriting the main Java application, which could possibly be used to escape the sandbox.

Comment 4 Cedric Buissart 🐶 2019-07-22 06:48:26 UTC
Acknowledgments:

Name: Imre Rad

Comment 11 Cedric Buissart 🐶 2019-07-31 13:42:47 UTC
Created icedtea-web tracking bugs for this issue:

Affects: fedora-all [bug 1734804]

Comment 12 errata-xmlrpc 2019-07-31 17:52:13 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:2004 https://access.redhat.com/errata/RHSA-2019:2004

Comment 13 errata-xmlrpc 2019-07-31 19:13:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2003 https://access.redhat.com/errata/RHSA-2019:2003

Comment 14 Product Security DevOps Team 2019-07-31 19:18:23 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10185

Comment 15 Cedric Buissart 🐶 2019-08-01 08:42:34 UTC
Mitigation:

No known mitigation.