Tóm tắt nhanh
- CVE-2021-32842 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng SharpZipLib, sharpziplib (sharpziplib project).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.90%, cao hơn 59.6% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 1.3.3 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| SharpZipLib NuGet | ≥ 1.0.0, < 1.3.3
| 1.3.3
|
| sharpziplib | ≥ 1.0.0, < 1.3.3
| 1.3.3
|
Mô tả
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that _baseDirectory ends with slash. If the _baseDirectory is not slash terminated like /home/user/dir it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. /home/user/dir.sh. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability.
Mô tả của NVD
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí