PT-2022-26150 · Lancet+1 · Lancet+1

Cokebeer · Published 2022-11-17 · Updated 2022-12-07 · CVE-2022-41920

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Lancet versions prior to 2.1.10 Lancet versions prior to 1.3.4

Description The issue is a ZipSlip problem that occurs when using the fileutil package to unzip files. This can be exploited when using the fileutil package. No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations For versions prior to 2.1.10, upgrade to version 2.1.10 or above. For versions prior to 1.3.4, upgrade to version 1.3.4 or above. As a temporary workaround, consider avoiding the use of the fileutil package to unzip files until a patch is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-41920

GHSA-PP3F-XRW5-Q5J4

GO-2022-1114

Affected Products

Lancet

Fileutils

References · 12

• 🔥 https://github.com/duke-git/lancet/security/advisories/GHSA-pp3f-xrw5-q5j4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41920.json · Exploit
• https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9 · Patch
• https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572 · Patch
• https://osv.dev/vulnerability/GO-2022-1114 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pp3f-xrw5-q5j4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41920 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41920 · Vendor Advisory
• https://github.com/duke-git/lancet · Note
• https://github.com/duke-git/lancet/issues/62 · Note
• https://t.me/cibsecurity/53079 · Telegram Post
• https://pkg.go.dev/vuln/GO-2022-1114 · Note