Bug 1724989 (CVE-2019-10185) - CVE-2019-10185 icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite
Summary: CVE-2019-10185 icedtea-web: directory traversal in the nested jar auto-extrac...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-10185
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1725945 1725946 1725947 1725948 1732552 1734804
Blocks: 1724963
TreeView+ depends on / blocked
 
Reported: 2019-06-28 08:24 UTC by Marian Rehak
Modified: 2021-02-16 21:47 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that icedtea-web was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
Clone Of:
Environment:
Last Closed: 2019-07-31 19:18:23 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2003 0 None None None 2019-07-31 19:13:04 UTC
Red Hat Product Errata RHSA-2019:2004 0 None None None 2019-07-31 17:52:14 UTC

Description Marian Rehak 2019-06-28 08:24:23 UTC 
The nested jar auto-extraction feature is vulnerable to "zip-slip" attacks, resulting in directory traversal. 

A specially crafted JAR file could use this flaw to write and overwrite arbitrary files. Combined with CVE-2019-10181, it can be used to rewriting the main Java application, which could possibly be used to escape the sandbox.
Comment 4 Cedric Buissart 2019-07-22 06:48:26 UTC 
Acknowledgments:

Name: Imre Rad
Comment 11 Cedric Buissart 2019-07-31 13:42:47 UTC 
Created icedtea-web tracking bugs for this issue:

Affects: fedora-all [bug 1734804]
Comment 12 errata-xmlrpc 2019-07-31 17:52:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:2004 https://access.redhat.com/errata/RHSA-2019:2004
Comment 13 errata-xmlrpc 2019-07-31 19:13:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2003 https://access.redhat.com/errata/RHSA-2019:2003
Comment 14 Product Security DevOps Team 2019-07-31 19:18:23 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10185
Comment 15 Cedric Buissart 2019-08-01 08:42:34 UTC 
Mitigation:

No known mitigation.
Comment 16 Cedric Buissart 2019-08-02 13:25:23 UTC 
Upstream fixes :

* 1.7 branch :
CVE-2019-10182 : https://github.com/AdoptOpenJDK/IcedTea-Web/commit/f9c2cf7fd24415ba2bb2619b69259035338ee5b6
CVE-2019-10185 : https://github.com/AdoptOpenJDK/IcedTea-Web/commit/26305807b41a5b4e9813db42531acd754899207f
CVE-2019-10181 : https://github.com/AdoptOpenJDK/IcedTea-Web/commit/32d174def953d801eb1cfc9d989bff5e80aac3cd

* 1.8 branch :
CVE-2019-10182 : https://github.com/AdoptOpenJDK/IcedTea-Web/commit/7958049eedc213be1ad4ae80ee312b167ddb320f
CVE-2019-10185 : https://github.com/AdoptOpenJDK/IcedTea-Web/commit/686213a6d68c21879d92cea3699b279c8f2662fa
CVE-2019-10181 : https://github.com/AdoptOpenJDK/IcedTea-Web/commit/528cb8163b7053576a658b9602b5694b21957b0e
Note You need to log in before you can comment on or make changes to this bug.