CVE-2020-9479 - unzip directory traversal

Back Back to CVE browser

MEDIUM

unzip directory traversal

Published Mar 1, 2021

5.5

MEDIUM

CVSS 3.1

EPSS 1.98%

Description

When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB

Affected products

Vendor Apache Software Foundation Product Apache AsterixDB Default
n/a
- Version
  Apache AsterixDB git
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache AsterixDB

n/a

Version	Status	Constraints
Apache AsterixDB git	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30296
Advisory
https://lists.apache.org/thread.html/r4cc9cc9c54573babf821c31d5d410fb260d1cd416dc1b225d587be9b%40%3Cdev.asterixdb.apache.org%3E
mailing-listx_refsource_MLIST
https://www.openwall.com/lists/oss-security/2020/08/08/2
x_refsource_MISCMailing ListThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30296		Advisory
https://lists.apache.org/thread.html/r4cc9cc9c54573babf821c31d5d410fb260d1cd416dc1b225d587be9b%40%3Cdev.asterixdb.apache.org%3E		mailing-listx_refsource_MLIST
https://www.openwall.com/lists/oss-security/2020/08/08/2		x_refsource_MISCMailing ListThird Party Advisory