CVE-2021-32842 — Path Traversal in Sharpziplib

CWE-22 — Path Traversal5 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.3%
top 46.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Icsharpcode SharpziplibSharpziplib Project SharpziplibDebian Mono
Timeline
PublishedJan 26
Latest updateFeb 1

Description

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5icsharpcode/sharpziplib1.3.3 — 1.3.3+1
▶NVDsharpziplib_project/sharpziplib1.0.0 — 1.3.3
▶NuGetsharpziplib_project/sharpziplib1.0.0 — 1.3.3
▶debiandebian/mono

🔴Vulnerability Details

3
GHSA
Path Traversal in SharpZipLib↗2022-02-01
▶
OSV
Path Traversal in SharpZipLib↗2022-02-01
▶
OSV
CVE-2021-32842: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library↗2022-01-26
▶

📋Vendor Advisories

1
Debian
CVE-2021-32842: mono - SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version...↗2021
▶