The vulnerability of the gzip library, related to errors in file name processing, allows attackers to write any files into the system.

🗓️ 12 Apr 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

The gzip library has a file name handling vulnerability that allows writing arbitrary files via zgrep and xzgrep.

Reporter	Title	Published	Views	Family All 360
ALT Linux	Security fix for the ALT Linux 9 package gzip version 1.10-alt1.p9.1	10 Apr 202300:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package gzip version 1.12-alt1	11 Apr 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	26 Oct 202218:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	25 Aug 202202:03	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities.	11 Apr 202311:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities.	22 Nov 202206:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	9 Nov 202218:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security bypass in GNU Gzip (CVE-2022-1271)	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in base image packages	7 Oct 202220:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Cloud Pak for Watson AIOPs	3 Oct 202218:44	–	ibm

Vulners

Node

red_hat red_hat_virtualizationMatch4

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

Source	Link
lists	www.lists.gnu.org/r/bug-gzip/2022-04/msg00011.html
access	www.access.redhat.com/security/cve/cve-2022-1271
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-1271
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
openwall	www.openwall.com/lists/oss-security/2022/04/07/8
git	www.git.tukaani.org/
mail-archive	www.mail-archive.com/search
redos	www.redos.red-soft.ru/support/secure/
goslinux	www.goslinux.fssp.gov.ru/2726972/
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16

19 Nov 2025 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 27.1

CVSS 37.1

EPSS0.04301

gzip library file name handling arbitrary file write zgrep usage xzgrep usage