PT-2019-19796 · Arch Linux · Pacman

Published 2019-03-11 · Updated 2020-11-09 · CVE-2019-9686

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pacman versions prior to 5.1.3

Description The issue allows directory traversal when installing a remote package via a specified URL, due to an unsanitized file name received from a Content-Disposition header. This can lead to arbitrary root code execution, bypassing package signature checking. A malicious server or a network MitM can send a Content-Disposition header to make pacman place the file anywhere in the filesystem.

Recommendations For versions prior to 5.1.3, update to version 5.1.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the -U option with URLs to minimize the risk of exploitation. Restrict access to the curl download internal function in lib/libalpm/dload.c to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-9686

Affected Products

Pacman

References · 5

• https://osv.dev/vulnerability/CVE-2019-9686 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9686 · Security Note
• https://git.archlinux.org/pacman.git/commit/?id=d197d8ab82cf10650487518fb968067897a12775 · Patch
• https://git.archlinux.org/pacman.git/commit/?id=9702703633bec2c007730006de2aeec8587dfc84 · Patch
• https://git.archlinux.org/pacman.git/commit/?h=release/5.1.x&id=1bf767234363f7ad5933af3f7ce267c123017bde · Note