PT-2024-11774 · Fdupes+1 · Fdupes+1

Wolfgang Frisch · Published 2024-04-26 · Updated 2024-10-27 · CVE-2022-48682

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions FDUPES versions prior to 2.2.0

Description A TOCTOU race condition in the deletefiles function allows for arbitrary file deletion via a symlink.

Recommendations For FDUPES versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2022-48682

OESA-2024-1532

OESA-2024-1615

OESA-2024-1616

Affected Products

Debian

Fdupes

References · 18

• https://osv.dev/vulnerability/OESA-2024-1615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48682 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-48682 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48682 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1532 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-48682 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48682 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1616 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48682 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48682 · Vendor Advisory
• https://github.com/adrianlopezroche/fdupes/compare/v2.1.2...v2.2.0 · Note
• https://github.com/adrianlopezroche/fdupes/commit/85680897148f1ac33b55418e00334116e419717f · Note
• https://github.com/adrianlopezroche/fdupes/blob/4b6bcde1b3eb1cebe87cd30814f7d6cf4ee46e95/fdupes.c · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1532 · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1616 · Note