Bug 1948752 (CVE-2021-29425) - CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
Summary: CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-29425
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1954898 1954899 1954900 1954901 1954902 1969298
Blocks: 1929333 1948753
TreeView+ depends on / blocked
 
Reported: 2021-04-12 20:37 UTC by Pedro Sampaio
Modified: 2021-09-30 09:58 UTC (History)
92 users (show)

Fixed In Version: apache-commons-io 2.7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-07-07 10:40:19 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2465 0 None None None 2021-07-07 06:29:47 UTC
Red Hat Product Errata RHSA-2021:3225 0 None None None 2021-08-19 07:18:44 UTC
Red Hat Product Errata RHSA-2021:3466 0 None None None 2021-09-08 14:06:51 UTC
Red Hat Product Errata RHSA-2021:3467 0 None None None 2021-09-08 14:09:09 UTC
Red Hat Product Errata RHSA-2021:3468 0 None None None 2021-09-08 14:04:47 UTC
Red Hat Product Errata RHSA-2021:3471 0 None None None 2021-09-08 13:06:04 UTC
Red Hat Product Errata RHSA-2021:3516 0 None None None 2021-09-13 17:34:17 UTC
Red Hat Product Errata RHSA-2021:3534 0 None None None 2021-09-14 12:37:48 UTC
Red Hat Product Errata RHSA-2021:3656 0 None None None 2021-09-23 16:15:48 UTC
Red Hat Product Errata RHSA-2021:3658 0 None None None 2021-09-23 16:24:06 UTC
Red Hat Product Errata RHSA-2021:3660 0 None None None 2021-09-23 16:29:56 UTC
Red Hat Product Errata RHSA-2021:3700 0 None None None 2021-09-30 09:58:11 UTC

Description Pedro Sampaio 2021-04-12 20:37:30 UTC
In Apache Commons IO before 2.7, When invoking the method
FileNameUtils.normalize with an improper input string, like
"//../foo", or "\\..\foo", the result would be the same value, thus
possibly providing access to files in the parent directory, but not
further above (thus "limited" path traversal), if the calling code
would use the result to construct a path value.

References:

https://www.openwall.com/lists/oss-security/2021/04/12/1
https://issues.apache.org/jira/browse/IO-556

Comment 21 errata-xmlrpc 2021-07-07 06:29:44 UTC
This issue has been addressed in the following products:

  Vert.x 4.1.0

Via RHSA-2021:2465 https://access.redhat.com/errata/RHSA-2021:2465

Comment 22 Product Security DevOps Team 2021-07-07 10:40:19 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-29425

Comment 23 errata-xmlrpc 2021-08-19 07:18:39 UTC
This issue has been addressed in the following products:

  Red Hat AMQ Streams 1.8.0

Via RHSA-2021:3225 https://access.redhat.com/errata/RHSA-2021:3225

Comment 24 errata-xmlrpc 2021-09-08 13:06:00 UTC
This issue has been addressed in the following products:

  EAP 7.3.9 release

Via RHSA-2021:3471 https://access.redhat.com/errata/RHSA-2021:3471

Comment 25 errata-xmlrpc 2021-09-08 14:04:42 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2021:3468 https://access.redhat.com/errata/RHSA-2021:3468

Comment 26 errata-xmlrpc 2021-09-08 14:06:46 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2021:3466 https://access.redhat.com/errata/RHSA-2021:3466

Comment 27 errata-xmlrpc 2021-09-08 14:09:06 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2021:3467 https://access.redhat.com/errata/RHSA-2021:3467

Comment 28 errata-xmlrpc 2021-09-13 17:34:13 UTC
This issue has been addressed in the following products:

  Red Hat EAP-XP 2.0.0 via EAP 7.3.x base

Via RHSA-2021:3516 https://access.redhat.com/errata/RHSA-2021:3516

Comment 29 errata-xmlrpc 2021-09-14 12:37:44 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.9

Via RHSA-2021:3534 https://access.redhat.com/errata/RHSA-2021:3534

Comment 30 errata-xmlrpc 2021-09-23 16:15:44 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2021:3656 https://access.redhat.com/errata/RHSA-2021:3656

Comment 31 errata-xmlrpc 2021-09-23 16:24:03 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2021:3658 https://access.redhat.com/errata/RHSA-2021:3658

Comment 32 errata-xmlrpc 2021-09-23 16:29:51 UTC
This issue has been addressed in the following products:

  EAP 7.4.1 release

Via RHSA-2021:3660 https://access.redhat.com/errata/RHSA-2021:3660

Comment 33 errata-xmlrpc 2021-09-30 09:58:08 UTC
This issue has been addressed in the following products:

  Red Hat AMQ 7.9.0

Via RHSA-2021:3700 https://access.redhat.com/errata/RHSA-2021:3700


Note You need to log in before you can comment on or make changes to this bug.