MEDIUM5.5

GHSA-hcxq-x77q-3469

Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver

Quick fix

GHSA-hcxq-x77q-3469 — org.codehaus.plexus:plexus-archiver: upgrade to the fixed version with the command below.

# pom.xml: bump <version>3.6.0</version> for org.codehaus.plexus:plexus-archiver

Details

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.codehaus.plexus:plexus-archiver

Introduced in: 0Fixed in: 3.6.0

Fix# pom.xml: bump <version>3.6.0</version> for org.codehaus.plexus:plexus-archiver

References

https://nvd.nist.gov/vuln/detail/CVE-2018-1002200[ADVISORY]
https://github.com/codehaus-plexus/plexus-archiver/pull/87[WEB]
https://github.com/codehaus-plexus/plexus-archiver/commit/f8f4233508193b70df33759ae9dc6154d69c2ea8[WEB]
https://access.redhat.com/errata/RHSA-2018:1836[WEB]
https://access.redhat.com/errata/RHSA-2018:1837[WEB]
https://github.com/codehaus-plexus/plexus-archiver[PACKAGE]
https://github.com/snyk/zip-slip-vulnerability[WEB]
https://snyk.io/research/zip-slip-vulnerability[WEB]
https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680[WEB]
https://www.debian.org/security/2018/dsa-4227[WEB]