UBUNTU-CVE-2023-37460

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2023-37460
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-37460.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-37460
Related
Published
2023-07-25T20:15:00Z
Modified
2024-12-18T16:36:22Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified Archiver/UnArchiver API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the resolveFile() function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later Files.newOutputStream(), that follows symlinks by default, will actually write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue.

References

Affected packages

Ubuntu:Pro:14.04:LTS / plexus-archiver

Package

Name
plexus-archiver
Purl
pkg:deb/ubuntu/plexus-archiver?arch=src?distro=esm-infra-legacy/trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0~alpha12-3
1.2-1
1.2-1+deb8u1build0.14.04.1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / plexus-archiver

Package

Name
plexus-archiver
Purl
pkg:deb/ubuntu/plexus-archiver?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2-1
2.2-1+deb9u1build0.16.04.1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / plexus-archiver

Package

Name
plexus-archiver
Purl
pkg:deb/ubuntu/plexus-archiver?arch=src?distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.5-2
3.5-2ubuntu0.1~esm1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / plexus-archiver

Package

Name
plexus-archiver
Purl
pkg:deb/ubuntu/plexus-archiver?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.6.0-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / plexus-archiver

Package

Name
plexus-archiver
Purl
pkg:deb/ubuntu/plexus-archiver?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.6.0-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / plexus-archiver

Package

Name
plexus-archiver
Purl
pkg:deb/ubuntu/plexus-archiver?arch=src?distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.6.1-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / plexus-archiver

Package

Name
plexus-archiver
Purl
pkg:deb/ubuntu/plexus-archiver?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.6.1-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}