Non notée
CVE-2022-37865 With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the…
Description
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Ivy 2.5 | premières → 2.5.0 | Pas de correctif indiqué |
| Apache Ivy 2.4 | 2.4.0 → dernières | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
- FEDORA-2023-35f775fd6e lists.fedoraproject.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Ivy
Les 4 CVE de Apache Ivy →
CVE-2026-26032
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a…
Non notée
CVE-2022-46751
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache…
Non notée
CVE-2022-37866
When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied…
Non notée