Not rated
CVE-2022-37865 With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the…
Description
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Ivy 2.5 | earliest → 2.5.0 | No fix stated |
| Apache Ivy 2.4 | 2.4.0 → latest | No fix stated |
References
- lists.apache.org lists.apache.org
- FEDORA-2023-35f775fd6e lists.fedoraproject.org
Timeline
- Published
- Last modified
Other CVEs of Apache Ivy
The 4 CVEs of Apache Ivy →
CVE-2026-26032
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a…
Not rated
CVE-2022-46751
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache…
Not rated
CVE-2022-37866
When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied…
Not rated