CVE-2022-1664

Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.

Database specific

{
    "cna_assigner":  "debian",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1664.json"
}

References

Affected packages

Git / git.dpkg.org/cgit/dpkg/dpkg.git

Affected ranges

Type

GIT

Repo

https://git.dpkg.org/cgit/dpkg/dpkg.git

Events

Introduced

47d2e9c479d6650e4980231606cd43c744e3c0c9

Fixed

e195a9f2ffd547e332f8f148a4135f537a5e77e7

Introduced

90d2887c67f2b1d0915169cc49725bb774083aba

Fixed

99902811cf1b1f41eed3bce2fc7ab8a4f02c364b

Introduced

314ac02663c5bd1a82b34745150bf13a39a549a3

Fixed

6247c7c3da135b41ac94af82e0b739cb40ba595d

Introduced

1f4238aba8850f83280ca88e14c7b48ee7e07d7e

Fixed

a154134fe70c0b823ae14905bdc33b64e7dcd454

Fixed

1f23dddc17f69c9598477098c7fb9936e15fa495

Fixed

58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5

Fixed

7a6c03cb34d4a09f35df2f10779cbf1b70a5200b

Fixed

faa4c92debe45412bfcf8a44f26e827800bb24be

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.14.17"
                },
                {
                    "fixed":  "1.18.26"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.19.0"
                },
                {
                    "fixed":  "1.19.8"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.20.0"
                },
                {
                    "fixed":  "1.20.10"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.21.0"
                },
                {
                    "fixed":  "1.21.8"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "1f23dddc17f69c9598477098c7fb9936e15fa495"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "7a6c03cb34d4a09f35df2f10779cbf1b70a5200b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "faa4c92debe45412bfcf8a44f26e827800bb24be"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*

1.14.17

1.14.18

1.15.0

1.15.1

1.15.2

1.15.3

1.15.4

1.15.5

1.15.5.1

1.15.6

1.15.6.1

1.15.7

1.15.8

1.16.0

1.16.1

1.16.10

1.16.2

1.16.3

1.16.4

1.16.5

1.16.6

1.17.0

1.17.1

1.17.10

1.17.11

1.17.12

1.17.13

1.17.14

1.17.15

1.17.16

1.17.17

1.17.18

1.17.19

1.17.2

1.17.20

1.17.21

1.17.22

1.17.23

1.17.3

1.17.4

1.17.5

1.17.6

1.17.7

1.17.8

1.17.9

1.18.0

1.18.1

1.18.10

1.18.11

1.18.12

1.18.13

1.18.14

1.18.15

1.18.16

1.18.17

1.18.18

1.18.19

1.18.2

1.18.20

1.18.21

1.18.22

1.18.23

1.18.24

1.18.25

1.18.3

1.18.4

1.18.5

1.18.6

1.18.7

1.18.8

1.18.9

1.19.0

1.19.1

1.19.2

1.19.3

1.19.4

1.19.5

1.19.6

1.19.7

1.20.0

1.20.1

1.20.2

1.20.3

1.20.4

1.20.5

1.20.6

1.20.7

1.20.8

1.20.9

1.21.0

1.21.1

1.21.2

1.21.3

1.21.4

1.21.5

1.21.6

1.21.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1664.json"