Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.
References
| Link | Resource |
|---|---|
| https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495 | Mailing List Patch Vendor Advisory |
| https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5 | Mailing List Patch Vendor Advisory |
| https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200b | Mailing List Patch Vendor Advisory |
| https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24be | Mailing List Patch Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2022/05/msg00033.html | Mailing List Vendor Advisory |
| https://lists.debian.org/debian-security-announce/2022/msg00115.html | Mailing List Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20221007-0002/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
03 Dec 2022, 02:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20221007-0002/ - Third Party Advisory | |
| CPE | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | |
| First Time |
Netapp ontap Select Deploy Administration Utility
Netapp |
07 Oct 2022, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Jun 2022, 18:18
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200b - Mailing List, Patch, Vendor Advisory | |
| References | (MISC) https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495 - Mailing List, Patch, Vendor Advisory | |
| References | (MISC) https://lists.debian.org/debian-lts-announce/2022/05/msg00033.html - Mailing List, Vendor Advisory | |
| References | (MISC) https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24be - Mailing List, Patch, Vendor Advisory | |
| References | (MISC) https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5 - Mailing List, Patch, Vendor Advisory | |
| References | (MISC) https://lists.debian.org/debian-security-announce/2022/msg00115.html - Mailing List, Vendor Advisory | |
| CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:* |
|
| First Time |
Debian debian Linux
Debian Debian dpkg |
|
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
26 May 2022, 14:25
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-05-26 14:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-1664
Mitre link : CVE-2022-1664
CVE.ORG link : CVE-2022-1664
JSON object : View
Products Affected
debian
- dpkg
- debian_linux
netapp
- ontap_select_deploy_administration_utility
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')