Veracode Vulnerability DatabaseVERACODE:27763Path Traversal
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
2.6 Low
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:N/I:P/A:N
file-roller is vulnerable to path traversal. An attacker is able to overwrite arbitrary files during archive extraction using ../ characters in a filename in a TAR archive.
| CPE | Name | Operator | Version |
|---|---|---|---|
| file-roller | eq | 3.28.1__1.el8 | |
| file-roller | eq | 3.28.1__2.el8 | |
| file-roller | eq | 3.28.1__1.el8 | |
| file-roller | eq | 3.28.1__2.el8 |
References
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
access.redhat.com/errata/RHSA-2020:4820
access.redhat.com/security/updates/classification/#moderate
bugzilla.gnome.org/show_bug.cgi?id=794337
bugzilla.redhat.com/show_bug.cgi?id=1767594
gitlab.gnome.org/GNOME/file-roller/commit/57268e51e59b61c9e3125eb0f65551c7084297e2
gitlab.gnome.org/GNOME/file-roller/commit/e8fb3e24dae711e4fb0d6777e0016cdda8787bc1
lists.debian.org/debian-lts-announce/2019/09/msg00032.html
seclists.org/bugtraq/2019/Sep/57
usn.ubuntu.com/4139-1/
www.debian.org/security/2019/dsa-4537
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
2.6 Low
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:N/I:P/A:N