NVD Vulnerability Detail

CVE-2018-1002200

Summary	plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Publication Date	July 26, 2018, 2:29 a.m.
Registration Date	March 1, 2021, 6:41 p.m.
Last Update	Nov. 21, 2024, 12:40 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:codehaus-plexus:plexus-archiver::::::::					3.6.0

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:debian:debian_linux:9.0:::::::*
cpe:2.3:o:redhat:enterprise_linux:7.5:::::::*

Related information, measures and tools

No	URL	タグ
1	https://access.redhat.com/errata/RHSA-2018:1836	Third Party Advisory
2	https://access.redhat.com/errata/RHSA-2018:1836	Third Party Advisory
3	https://access.redhat.com/errata/RHSA-2018:1837	Third Party Advisory
4	https://access.redhat.com/errata/RHSA-2018:1837	Third Party Advisory
5	https://github.com/codehaus-plexus/plexus-archiver/commit/f8f4233508193b70df33759ae9dc6154d69c2ea8	Issue Tracking Patch Third Party Advisory
6	https://github.com/codehaus-plexus/plexus-archiver/commit/f8f4233508193b70df33759ae9dc6154d69c2ea8	Issue Tracking Patch Third Party Advisory
7	https://github.com/codehaus-plexus/plexus-archiver/pull/87	Exploit Issue Tracking Patch Third Party Advisory
8	https://github.com/codehaus-plexus/plexus-archiver/pull/87	Exploit Issue Tracking Patch Third Party Advisory
9	https://github.com/snyk/zip-slip-vulnerability	Exploit Issue Tracking Third Party Advisory
10	https://github.com/snyk/zip-slip-vulnerability	Exploit Issue Tracking Third Party Advisory
11	https://snyk.io/research/zip-slip-vulnerability	Exploit Third Party Advisory
12	https://snyk.io/research/zip-slip-vulnerability	Exploit Third Party Advisory
13	https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680	Exploit Third Party Advisory
14	https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680	Exploit Third Party Advisory
15	https://www.debian.org/security/2018/dsa-4227	Third Party Advisory
16	https://www.debian.org/security/2018/dsa-4227	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

plexus-archiver におけるパストラバーサルの脆弱性

Title	plexus-archiver におけるパストラバーサルの脆弱性
Summary	plexus-archiver には、パストラバーサルの脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 6, 2018, midnight
Registration Date	Oct. 12, 2018, 5:48 p.m.
Last Update	Oct. 12, 2018, 5:48 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux

Red Hat Enterprise Linux Desktop

Red Hat Enterprise Linux Workstation

Debian

Debian GNU/Linux

Codehaus Plexus

Plexus-archiver 3.6.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-1002200	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1002200
National Vulnerability Database (NVD)
2	CVE-2018-1002200	https://nvd.nist.gov/vuln/detail/CVE-2018-1002200

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-4227	https://www.debian.org/security/2018/dsa-4227
GitHub
2	fix: fail when trying to extract outside of dest dir #87	https://github.com/codehaus-plexus/plexus-archiver/pull/87
3	Merge pull request #87 from odinn1984/fix/fail_on_outside_target_files	https://github.com/codehaus-plexus/plexus-archiver/commit/f8f4233508193b70df33759ae9dc6154d69c2ea8
Red Hat Security Advisory
4	RHSA-2018:1836	https://access.redhat.com/errata/RHSA-2018:1836
5	RHSA-2018:1837	https://access.redhat.com/errata/RHSA-2018:1837

Change Log

No	Changed Details	Date of change
1	[2018年10月12日] 掲載	Oct. 12, 2018, 5:48 p.m.