GHSA-94rr-4jr5-9h2p

Suggest an improvement
Source
https://github.com/advisories/GHSA-94rr-4jr5-9h2p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-94rr-4jr5-9h2p/GHSA-94rr-4jr5-9h2p.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-94rr-4jr5-9h2p
Aliases
Published
2022-11-07T12:00:33Z
Modified
2024-02-14T05:31:13.062926Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
Apache Ivy does not verify target path when extracting the archive
Details

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging.

For artifacts using the "zip", "jar" or "war" packaging Ivy prior to version 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to.

Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy version 2.5.1.

Database specific
{
    "nvd_published_at": "2022-11-07T11:15:00Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-07T16:11:25Z"
}
References

Affected packages

Maven / org.apache.ivy:ivy

Package

Name
org.apache.ivy:ivy
View open source insights on deps.dev
Purl
pkg:maven/org.apache.ivy/ivy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.4.0
Fixed
2.5.1

Affected versions

2.*

2.4.0
2.5.0-rc1
2.5.0