OESA-2024-1589

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1589

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2024-1589.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2024-1589

Upstream

CVE-2023-52138

Published

2024-05-17T11:08:00Z

Modified

2025-08-12T05:39:57.422717Z

Summary

engrampa security update

Details

Mate File Archiver is an application for creating and viewing archives files, such as zip, xv, bzip2, cab, rar and other compress formats.

Security Fix(es):

Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio or ISO archive to achieve RCE on the target system. This vulnerability was fixed in commit 63d5dfa. (CVE-2023-52138)

Database specific

{
    "severity": "Critical"
}

References

Affected packages

openEuler:22.03-LTS-SP3 / engrampa

Package

Name: engrampa
Purl: pkg:rpm/openEuler/engrampa&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.24.1-4.oe2203sp3

Ecosystem specific

{
    "x86_64": [
        "engrampa-debugsource-1.24.1-4.oe2203sp3.x86_64.rpm",
        "engrampa-1.24.1-4.oe2203sp3.x86_64.rpm",
        "engrampa-debuginfo-1.24.1-4.oe2203sp3.x86_64.rpm"
    ],
    "src": [
        "engrampa-1.24.1-4.oe2203sp3.src.rpm"
    ],
    "aarch64": [
        "engrampa-debuginfo-1.24.1-4.oe2203sp3.aarch64.rpm",
        "engrampa-1.24.1-4.oe2203sp3.aarch64.rpm",
        "engrampa-debugsource-1.24.1-4.oe2203sp3.aarch64.rpm"
    ]
}