CVE-2021-32841

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that destDir ends with slash. If the destDir is not slash terminated like /home/user/dir it is possible to create a file with a name thats begins with the destination directory, i.e. /home/user/dir.sh. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.

References

Affected packages

Git / github.com/icsharpcode/sharpziplib

Affected ranges

Type

GIT

Repo

https://github.com/icsharpcode/sharpziplib

Events

Introduced

8f7d89201afa13c814f9b3d1813884ffe0ec7025

Fixed

1b1ab013ce1df02d8f27cf582197759c614d9126

Fixed

5c3b293de5d65b108e7f2cd0ea8f81c1b8273f78

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:sharpziplib_project:sharpziplib:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.3.0"
                },
                {
                    "fixed":  "1.3.3"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "5c3b293de5d65b108e7f2cd0ea8f81c1b8273f78"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.3.3",
            "range":  [
                {
                    "fixed":  "1b1ab013ce1df02d8f27cf582197759c614d9126"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*

v1.3.0

v1.3.1

v1.3.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32841.json"