PT-2022-7284 · Apache+1 · Apache Ivy+1

Kostya Kortchinsky · Published 2022-11-07 · Updated 2024-12-03 · CVE-2022-37865

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Ivy versions 2.4.0 through 2.5.0

Description The issue is related to the extraction of archives in Apache Ivy, where the target path is not verified for artifacts using "zip", "jar", or "war" packaging. This allows an archive with absolute paths or paths that traverse "upwards" using ".." sequences to write files to any location on the local file system that the user executing Ivy has write access to.

Recommendations For Apache Ivy versions 2.4.0 to 2.5.0, upgrade to Ivy version 2.5.1 to resolve the issue. As a temporary workaround, consider restricting the use of the archive extraction feature until the upgrade is applied. Avoid using archives with absolute paths or paths that traverse "upwards" using ".." sequences in the affected API endpoint until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-02278

CVE-2022-37865

GHSA-94RR-4JR5-9H2P

MGASA-2023-0216

OPENSUSE-SU-2024:12506-1

Affected Products

Apache Ivy

Red Os

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2022-37865 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37865 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0216 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-94rr-4jr5-9h2p · Vendor Advisory
• https://lists.apache.org/thread/gqvvv7qsm2dfjg6xzsw1s2h08tbr0sdy · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02278 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0216.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12506-1 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-apache-ivy-cve-2022-37866-cve-2022-37865/?sphrase_id=592511 · Note
• https://suse.com/security/cve/CVE-2022-37865 · Note
• https://suse.com/security/cve/CVE-2022-37865.html · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-apache-ivy-cve-2022-37866-cve-2022-37865 · Note
• https://openwall.com/lists/oss-security/2022/11/04/2 · Note