Bug 1948752 (CVE-2021-29425)

Summary:	CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, asoldano, atangrin, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, cdewolf, chazlett, clement.escoffier, dandread, darran.lofthouse, dkreling, dosoudil, drieden, eleandro, etirelli, fjuma, ggaughan, gmalinko, gsmet, gvarsami, hamadhan, hhorak, ibek, igueye, iweiss, janstey, java-maint, java-maint-sig, java-sig-commits, jcoleman, jochrist, jolee, jorton, jpallich, jperkins, jross, jschatte, jstastny, jwon, kaycoth, kconner, krathod, kverlaen, kwills, ldimaggi, lgao, loleary, lthon, mizdebsk, mnovotny, msochure, msvehla, mszynkie, nwallace, pdrozd, peholase, pgallagh, pjindal, pmackay, probinso, qe-baseos-apps, rguimara, rhcs-maint, rrajasek, rruss, rstancel, rsvoboda, rwagner, sbiarozk, sdouglas, sgehwolf, smaestri, SpikeFedora, spinder, sthorger, stuart, swoodman, tcunning, theute, tkirby, tom.jenkinson, tzimanyi, yborgess
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	apache-commons-io 2.7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-07-07 10:40:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1954898, 1954899, 1954900, 1954901, 1954902, 1969298
Bug Blocks:	1929333, 1948753

Description Pedro Sampaio 2021-04-12 20:37:30 UTC

In Apache Commons IO before 2.7, When invoking the method
FileNameUtils.normalize with an improper input string, like
"//../foo", or "\\..\foo", the result would be the same value, thus
possibly providing access to files in the parent directory, but not
further above (thus "limited" path traversal), if the calling code
would use the result to construct a path value.

References:

https://www.openwall.com/lists/oss-security/2021/04/12/1
https://issues.apache.org/jira/browse/IO-556

Comment 21 errata-xmlrpc 2021-07-07 06:29:44 UTC

This issue has been addressed in the following products:

  Vert.x 4.1.0

Via RHSA-2021:2465 https://access.redhat.com/errata/RHSA-2021:2465

Comment 22 Product Security DevOps Team 2021-07-07 10:40:19 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-29425

Comment 23 errata-xmlrpc 2021-08-19 07:18:39 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Streams 1.8.0

Via RHSA-2021:3225 https://access.redhat.com/errata/RHSA-2021:3225

Comment 24 errata-xmlrpc 2021-09-08 13:06:00 UTC

This issue has been addressed in the following products:

  EAP 7.3.9 release

Via RHSA-2021:3471 https://access.redhat.com/errata/RHSA-2021:3471

Comment 25 errata-xmlrpc 2021-09-08 14:04:42 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2021:3468 https://access.redhat.com/errata/RHSA-2021:3468

Comment 26 errata-xmlrpc 2021-09-08 14:06:46 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2021:3466 https://access.redhat.com/errata/RHSA-2021:3466

Comment 27 errata-xmlrpc 2021-09-08 14:09:06 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2021:3467 https://access.redhat.com/errata/RHSA-2021:3467

Comment 28 errata-xmlrpc 2021-09-13 17:34:13 UTC

This issue has been addressed in the following products:

  Red Hat EAP-XP 2.0.0 via EAP 7.3.x base

Via RHSA-2021:3516 https://access.redhat.com/errata/RHSA-2021:3516

Comment 29 errata-xmlrpc 2021-09-14 12:37:44 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.9

Via RHSA-2021:3534 https://access.redhat.com/errata/RHSA-2021:3534

Comment 30 errata-xmlrpc 2021-09-23 16:15:44 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2021:3656 https://access.redhat.com/errata/RHSA-2021:3656

Comment 31 errata-xmlrpc 2021-09-23 16:24:03 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2021:3658 https://access.redhat.com/errata/RHSA-2021:3658

Comment 32 errata-xmlrpc 2021-09-23 16:29:51 UTC

This issue has been addressed in the following products:

  EAP 7.4.1 release

Via RHSA-2021:3660 https://access.redhat.com/errata/RHSA-2021:3660

Comment 33 errata-xmlrpc 2021-09-30 09:58:08 UTC

This issue has been addressed in the following products:

  Red Hat AMQ 7.9.0

Via RHSA-2021:3700 https://access.redhat.com/errata/RHSA-2021:3700

Comment 36 errata-xmlrpc 2021-12-14 21:35:09 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.10

Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134

Comment 37 errata-xmlrpc 2022-03-29 13:00:32 UTC

This issue has been addressed in the following products:

  RHPAM 7.12.1

Via RHSA-2022:1108 https://access.redhat.com/errata/RHSA-2022:1108

Comment 38 errata-xmlrpc 2022-03-29 13:16:36 UTC

This issue has been addressed in the following products:

  RHDM 7.12.1

Via RHSA-2022:1110 https://access.redhat.com/errata/RHSA-2022:1110