codehaus-plexus__plexus-archiver_CVE-2018-1002200_3-5

Plexus-archiver The current master is now at https://github.com/codehaus-plexus/plexus-archiver Release Notes You can find details about the different releases in the Release Notes. Release 3.4. Release 3.3. Release 3.2...

RHEL 6 / 7 : rh-maven33-plexus-archiver and rh-maven35-plexus-archiver (RHSA-2018:1837)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1837 advisory. The Plexus project provides a full software stack for creating and executing software projects. Based on the Plexus container, the applications c...

K64709522: Multiple Zip Slip vulnerabilities

Security Advisory Description CVE-2018-1002200 plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

com.jayway.maven.plugins.android.generation1.plugins:maven-par-plugin (>=1.0.1, <=1.0.2), org.apache.directory.studio:maven-studio-plugin (1.0.0) +19 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (1.0-alpha-10)

org.codehaus.plexus:plexus-archiver MAVEN version 1.0-alpha-10 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.jayway.maven.plugins.android.generation1.plugins:maven-par-plugin =1.0.1,...

com.sun.enterprise:hk2-maven (>=0.2, <=1.6.9), com.sun.enterprise:hk2-maven-plugin (>=0.2, <=1.6.9) +27 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (1.0-alpha-4)

org.codehaus.plexus:plexus-archiver MAVEN version 1.0-alpha-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.sun.enterprise:hk2-maven =0.2, =0.2, =0.0.1, =1.46, =3.2, =3.2, =3.2, =1.0-rc4,...

com.github.jlgrock.javascript-framework:source-archive-maven-plugin (>=1.10.3, <=1.18.3), com.savage7.maven.plugins:maven-external-dependency-plugin (0.5) +2 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (1.1)

org.codehaus.plexus:plexus-archiver MAVEN version 1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.github.jlgrock.javascript-framework:source-archive-maven-plugin =1.10.3, =2.2, =2.0.7,...

cn.wanghaomiao:maven-seimicrawler-plugin (>=1.0.0, <=1.3.0), com.appneta.agent.java:appneta-maven-plugin (1.0.0) +33 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (2.9)

org.codehaus.plexus:plexus-archiver MAVEN version 2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - cn.wanghaomiao:maven-seimicrawler-plugin =1.0.0, =0.9.0, =0.0.1, =1.0.1, =0.0.1, =0.0.3,...

at.bestsolution:maven-osgi-package-plugin (0.0.1), ch.rasc:embeddedtc-maven-plugin (>=1.18, <=1.19) +59 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (2.9.1)

org.codehaus.plexus:plexus-archiver MAVEN version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - at.bestsolution:maven-osgi-package-plugin 0.0.1 - ch.rasc:embeddedtc-maven-plugin =1.18,...

org.apache.maven.plugins:maven-ear-plugin (2.10.1) potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (2.10.3)

org.codehaus.plexus:plexus-archiver MAVEN version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - org.apache.maven.plugins:maven-ear-plugin 2.10.1 Source cves: CVE-2018-1002200 Source...

org.eclipse.tycho.extras:target-platform-validation-plugin (0.23.0), org.eclipse.tycho.extras:tycho-buildtimestamp-jgit (0.23.0) +20 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (2.10.1)

org.codehaus.plexus:plexus-archiver MAVEN version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - org.eclipse.tycho.extras:target-platform-validation-plugin 0.23.0 -...

CVE-2018-1002200

A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names. A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or...

NewStart CGSL CORE 5.04 / MAIN 5.04 : plexus-archiver Vulnerability (NS-SA-2019-0041)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has plexus-archiver packages installed that are affected by a vulnerability: - A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file...

Updated plexus-archiver packages fix security vulnerability

A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names. A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or...

CVE-2018-1002200

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

CVE-2018-1002200

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

CVE-2018-1002200

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

at.bestsolution:maven-osgi-package-plugin (0.0.1), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.1.1) +2073 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (>=1.0-alpha-3, <=3.5)

org.codehaus.plexus:plexus-archiver MAVEN version =1.0-alpha-3, =9.1.1, =1.0, =0.1-1, =0.7.8, =0.6.0, =0.6.0, =0.6.0, =1.4.14, =1.2.1, =0.9.0, =ccbc95eb, =121807cc and more Source cves: CVE-2018-1002200 Source advisory: MEND:CVE-2018-1002200...

CVE-2018-1002200

CVE-2018-1002200 affects plexus-archiver prior to 3.6.0, which is vulnerable to a directory traversal (Zip-Slip) that allows an attacker extracting a crafted archive to write to arbitrary files. Impact observed in multiple advisories: arbitrary file write/overwrite by exploiting zip entry path tr...

Important: plexus-archiver

Issue Overview: A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names. A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with...

Fedora Update for plexus-archiver FEDORA-2018-6c55e1f79c

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...