PT-2022-10094 · Unknown · Sharpziplib

Jarlob + 1 · Published 2022-01-26 · Updated 2022-02-07 · CVE-2021-32840

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SharpZipLib versions prior to 1.3.3

Description The issue affects SharpZipLib, a library for handling Zip, GZip, Tar, and BZip2 files. In versions prior to 1.3.3, a TAR file entry such as ../evil.txt may be extracted to the parent directory of the destination folder, potentially leading to arbitrary file write and code execution.

Recommendations For versions prior to 1.3.3, update to version 1.3.3 to resolve the issue. As a temporary workaround, consider restricting the extraction of TAR files to prevent writing to parent directories until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-32840

GHSA-M22M-H4RF-PWQ3

Affected Products

Sharpziplib

References · 11

• 🔥 https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib · Exploit
• https://github.com/icsharpcode/SharpZipLib/commit/a0e96de70b5264f4c919b09253b1522bc7a221cc · Patch
• https://osv.dev/vulnerability/GHSA-m22m-h4rf-pwq3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32840 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32840 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32840 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32840 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32840 · Vendor Advisory
• https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3 · Note
• https://github.com/icsharpcode/SharpZipLib · Note
• https://t.me/cibsecurity/36356 · Telegram Post