Bug 2182188 (CVE-2022-37865) - CVE-2022-37865 apache-ivy: Directory Traversal
Summary: CVE-2022-37865 apache-ivy: Directory Traversal
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-37865
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2182189 2182260 2182261 2182262 2182263
Blocks: 2140156
TreeView+ depends on / blocked
 
Reported: 2023-03-27 20:12 UTC by Patrick Del Bello
Modified: 2023-09-22 09:38 UTC (History)
53 users (show)

Fixed In Version: Apache Ivy 2.5.1
Clone Of:
Environment:
Last Closed: 2023-05-03 19:49:11 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:2100 0 None None None 2023-05-03 14:07:16 UTC

Description Patrick Del Bello 2023-03-27 20:12:51 UTC 
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.

https://lists.apache.org/thread/gqvvv7qsm2dfjg6xzsw1s2h08tbr0sdy
Comment 1 Patrick Del Bello 2023-03-27 20:13:15 UTC 
Created apache-ivy tracking bugs for this issue:

Affects: fedora-all [bug 2182189]
Comment 5 errata-xmlrpc 2023-05-03 14:07:13 UTC 
This issue has been addressed in the following products:

  RHINT Camel-Springboot 3.20.1

Via RHSA-2023:2100 https://access.redhat.com/errata/RHSA-2023:2100
Comment 6 Product Security DevOps Team 2023-05-03 19:49:07 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-37865
Note You need to log in before you can comment on or make changes to this bug.