PT-2022-10095 · Unknown · Sharpziplib

Jarlob + 1 · Published 2022-01-26 · Updated 2022-02-07 · CVE-2021-32841

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SharpZipLib versions 1.3.0 through 1.3.2

Description The issue affects SharpZipLib, a library for handling Zip, GZip, Tar, and BZip2 files. It arises from the lack of enforcement that the destination directory path ends with a slash, allowing for the creation of files with names that start with the destination directory path under specific conditions. The impact of this issue is limited due to file name and destination directory constraints, and it varies depending on the use case.

Recommendations For versions 1.3.0 through 1.3.2, update to version 1.3.3, which contains a patch for this issue. As a temporary workaround, consider ensuring that the destDir path always ends with a slash to prevent unintended file creation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-32841

GHSA-2X7H-96H5-RQ84

Affected Products

Sharpziplib

References · 11

• 🔥 https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib · Exploit
• https://github.com/icsharpcode/SharpZipLib/commit/5c3b293de5d65b108e7f2cd0ea8f81c1b8273f78 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32841 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32841 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32841 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32841 · Security Note
• https://osv.dev/vulnerability/GHSA-2x7h-96h5-rq84 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32841 · Vendor Advisory
• https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3 · Note
• https://github.com/icsharpcode/SharpZipLib · Note
• https://t.me/cibsecurity/36357 · Telegram Post