CVE-2020-9479

2021-03-0116:15:12

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.8%

JSON

When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB

CPENameOperatorVersion
asterixdbeqault/hyracks_lsm_length_filter
asterixdbeqasterix-0.8.1
asterixdbeqfullstack-0.2.7
asterixdbeqault/asterix_fix_agg
asterixdbeqault/asterix_lsm_stabilization_interval_leftover
asterixdbeqault/asterix_inline_vars
asterixdbeqault/asterix_lsm_stabilization_315
asterixdbeqault/asterix_unnest_to_join_enhance
asterixdbeqault/fullstack_imru@2585
asterixdbeqault/asterix-fix-issue-109

Name	Operator	Version
asterixdb	eq	ault/hyracks_lsm_length_filter
asterixdb	eq	asterix-0.8.1
asterixdb	eq	fullstack-0.2.7
asterixdb	eq	ault/asterix_fix_agg
asterixdb	eq	ault/asterix_lsm_stabilization_interval_leftover
asterixdb	eq	ault/asterix_inline_vars
asterixdb	eq	ault/asterix_lsm_stabilization_315
asterixdb	eq	ault/asterix_unnest_to_join_enhance
asterixdb	eq	ault/fullstack_imru@2585
asterixdb	eq	ault/asterix-fix-issue-109