plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
Published Jul 25, 2018
7.3
HIGHCVSS 3.0
EPSS 11.58%
Description
plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<3.6.0
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Codehaus | Plexus-Archiver | n/a |
|
Configuration 1
- < 3.6.0
Configuration 2
- 8.0
- 9.0
- 7.5
- 7.0
- 7.0
No data.
Red Hat Enterprise Linux 7
plexus-archiver-0:2.4.2-5.el7_5
Fixed · RHSA-2018:1836
Red Hat Software Collections for Red Hat Enterprise Linux 6
rh-maven33-plexus-archiver-0:2.4.2-5.1.el6
Fixed · RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
rh-maven33-plexus-archiver-0:2.4.2-5.1.el6
Fixed · RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-maven33-plexus-archiver-0:2.4.2-5.1.el7
Fixed · RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-maven35-plexus-archiver-0:3.4-4.1.el7
Fixed · RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
rh-maven33-plexus-archiver-0:2.4.2-5.1.el7
Fixed · RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
rh-maven35-plexus-archiver-0:3.4-4.1.el7
Fixed · RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
rh-maven33-plexus-archiver-0:2.4.2-5.1.el7
Fixed · RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
rh-maven35-plexus-archiver-0:3.4-4.1.el7
Fixed · RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
rh-maven33-plexus-archiver-0:2.4.2-5.1.el7
Fixed · RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
rh-maven35-plexus-archiver-0:3.4-4.1.el7
Fixed · RHSA-2018:1837
JBoss Developer Studio 9
plexus-archiver
Not affected
Red Hat Enterprise Linux 8
plexus-archiver
Not affected
Red Hat Fuse 7
plexus-archiver
Not affected
Red Hat JBoss Fuse Integration Service 2
plexus-archiver
Not affected
Red Hat OpenStack Platform 9 (Mitaka)
opendaylight
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | plexus-archiver-0:2.4.2-5.el7_5 | Fixed | RHSA-2018:1836 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-maven33-plexus-archiver-0:2.4.2-5.1.el6 | Fixed | RHSA-2018:1837 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | rh-maven33-plexus-archiver-0:2.4.2-5.1.el6 | Fixed | RHSA-2018:1837 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-maven33-plexus-archiver-0:2.4.2-5.1.el7 | Fixed | RHSA-2018:1837 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-maven35-plexus-archiver-0:3.4-4.1.el7 | Fixed | RHSA-2018:1837 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS | rh-maven33-plexus-archiver-0:2.4.2-5.1.el7 | Fixed | RHSA-2018:1837 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS | rh-maven35-plexus-archiver-0:3.4-4.1.el7 | Fixed | RHSA-2018:1837 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | rh-maven33-plexus-archiver-0:2.4.2-5.1.el7 | Fixed | RHSA-2018:1837 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | rh-maven35-plexus-archiver-0:3.4-4.1.el7 | Fixed | RHSA-2018:1837 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | rh-maven33-plexus-archiver-0:2.4.2-5.1.el7 | Fixed | RHSA-2018:1837 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | rh-maven35-plexus-archiver-0:3.4-4.1.el7 | Fixed | RHSA-2018:1837 |
| JBoss Developer Studio 9 | plexus-archiver | Not affected | n/a |
| Red Hat Enterprise Linux 8 | plexus-archiver | Not affected | n/a |
| Red Hat Fuse 7 | plexus-archiver | Not affected | n/a |
| Red Hat JBoss Fuse Integration Service 2 | plexus-archiver | Not affected | n/a |
| Red Hat OpenStack Platform 9 (Mitaka) | opendaylight | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (13)
- https://access.redhat.com/errata/RHSA-2018:1836 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1837 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2018-1002200 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1584392 Issue Tracking
- https://github.com/advisories/GHSA-hcxq-x77q-3469 Advisory
- https://github.com/codehaus-plexus/plexus-archiver/commit/f8f4233508193b70df33759ae9dc6154d69c2ea8 x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
- https://github.com/codehaus-plexus/plexus-archiver/pull/87 x_refsource_CONFIRMExploitIssue TrackingPatchThird Party Advisory
- https://github.com/snyk/zip-slip-vulnerability x_refsource_MISCExploitIssue TrackingThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-1002200
- https://snyk.io/research/zip-slip-vulnerability x_refsource_MISCExploitThird Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680 x_refsource_MISCExploitThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-1002200
- https://www.debian.org/security/2018/dsa-4227 vendor-advisoryx_refsource_DEBIANThird Party Advisory
Change history (0)
No recorded changes yet.