CVE-2022-37865

published 2022-11-07

CVE-2022-37865: With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip…

Priority P3 51 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C N I H A H

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	ivy	>= 2.4.0 < 2.5.1	2.5.1
apache_software_foundation	apache_ivy	>= 2.4.0 < unspecified	unspecified
apache_software_foundation	apache_ivy	unspecified – 2.5.0	—

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vendor_oracle 9.1 CRITICAL

vendor_redhat 9.1 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22