Bug 1948752 (CVE-2021-29425) - CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
Summary: CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-29425
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1954898 1954899 1954900 1954901 1954902 1969298
Blocks: 1929333 1948753
TreeView+ depends on / blocked
 
Reported: 2021-04-12 20:37 UTC by Pedro Sampaio
Modified: 2022-03-29 13:16 UTC (History)
92 users (show)

Fixed In Version: apache-commons-io 2.7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-07-07 10:40:19 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2465 0 None None None 2021-07-07 06:29:47 UTC
Red Hat Product Errata RHSA-2021:3225 0 None None None 2021-08-19 07:18:44 UTC
Red Hat Product Errata RHSA-2021:3466 0 None None None 2021-09-08 14:06:51 UTC
Red Hat Product Errata RHSA-2021:3467 0 None None None 2021-09-08 14:09:09 UTC
Red Hat Product Errata RHSA-2021:3468 0 None None None 2021-09-08 14:04:47 UTC
Red Hat Product Errata RHSA-2021:3471 0 None None None 2021-09-08 13:06:04 UTC
Red Hat Product Errata RHSA-2021:3516 0 None None None 2021-09-13 17:34:17 UTC
Red Hat Product Errata RHSA-2021:3534 0 None None None 2021-09-14 12:37:48 UTC
Red Hat Product Errata RHSA-2021:3656 0 None None None 2021-09-23 16:15:48 UTC
Red Hat Product Errata RHSA-2021:3658 0 None None None 2021-09-23 16:24:06 UTC
Red Hat Product Errata RHSA-2021:3660 0 None None None 2021-09-23 16:29:56 UTC
Red Hat Product Errata RHSA-2021:3700 0 None None None 2021-09-30 09:58:11 UTC
Red Hat Product Errata RHSA-2021:5134 0 None None None 2021-12-14 21:35:14 UTC
Red Hat Product Errata RHSA-2022:1108 0 None None None 2022-03-29 13:00:38 UTC
Red Hat Product Errata RHSA-2022:1110 0 None None None 2022-03-29 13:16:41 UTC

Description Pedro Sampaio 2021-04-12 20:37:30 UTC 
In Apache Commons IO before 2.7, When invoking the method
FileNameUtils.normalize with an improper input string, like
"//../foo", or "\\..\foo", the result would be the same value, thus
possibly providing access to files in the parent directory, but not
further above (thus "limited" path traversal), if the calling code
would use the result to construct a path value.

References:

https://www.openwall.com/lists/oss-security/2021/04/12/1
https://issues.apache.org/jira/browse/IO-556
Comment 21 errata-xmlrpc 2021-07-07 06:29:44 UTC 
This issue has been addressed in the following products:

  Vert.x 4.1.0

Via RHSA-2021:2465 https://access.redhat.com/errata/RHSA-2021:2465
Comment 22 Product Security DevOps Team 2021-07-07 10:40:19 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-29425
Comment 23 errata-xmlrpc 2021-08-19 07:18:39 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ Streams 1.8.0

Via RHSA-2021:3225 https://access.redhat.com/errata/RHSA-2021:3225
Comment 24 errata-xmlrpc 2021-09-08 13:06:00 UTC 
This issue has been addressed in the following products:

  EAP 7.3.9 release

Via RHSA-2021:3471 https://access.redhat.com/errata/RHSA-2021:3471
Comment 25 errata-xmlrpc 2021-09-08 14:04:42 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2021:3468 https://access.redhat.com/errata/RHSA-2021:3468
Comment 26 errata-xmlrpc 2021-09-08 14:06:46 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2021:3466 https://access.redhat.com/errata/RHSA-2021:3466
Comment 27 errata-xmlrpc 2021-09-08 14:09:06 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2021:3467 https://access.redhat.com/errata/RHSA-2021:3467
Comment 28 errata-xmlrpc 2021-09-13 17:34:13 UTC 
This issue has been addressed in the following products:

  Red Hat EAP-XP 2.0.0 via EAP 7.3.x base

Via RHSA-2021:3516 https://access.redhat.com/errata/RHSA-2021:3516
Comment 29 errata-xmlrpc 2021-09-14 12:37:44 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.9

Via RHSA-2021:3534 https://access.redhat.com/errata/RHSA-2021:3534
Comment 30 errata-xmlrpc 2021-09-23 16:15:44 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2021:3656 https://access.redhat.com/errata/RHSA-2021:3656
Comment 31 errata-xmlrpc 2021-09-23 16:24:03 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2021:3658 https://access.redhat.com/errata/RHSA-2021:3658
Comment 32 errata-xmlrpc 2021-09-23 16:29:51 UTC 
This issue has been addressed in the following products:

  EAP 7.4.1 release

Via RHSA-2021:3660 https://access.redhat.com/errata/RHSA-2021:3660
Comment 33 errata-xmlrpc 2021-09-30 09:58:08 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ 7.9.0

Via RHSA-2021:3700 https://access.redhat.com/errata/RHSA-2021:3700
Comment 36 errata-xmlrpc 2021-12-14 21:35:09 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.10

Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134
Comment 37 errata-xmlrpc 2022-03-29 13:00:32 UTC 
This issue has been addressed in the following products:

  RHPAM 7.12.1

Via RHSA-2022:1108 https://access.redhat.com/errata/RHSA-2022:1108
Comment 38 errata-xmlrpc 2022-03-29 13:16:36 UTC 
This issue has been addressed in the following products:

  RHDM 7.12.1

Via RHSA-2022:1110 https://access.redhat.com/errata/RHSA-2022:1110
Note You need to log in before you can comment on or make changes to this bug.