| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.scala-sbt:io_2.12 | ≥ 1.0.0, < 1.9.7 | 1.9.7 |
| org.scala-sbt:io_2.13 | ≥ 1.0.0, < 1.9.7 | 1.9.7 |
| org.scala-sbt:io_3 | ≥ 1.0.0, < 1.9.7 | 1.9.7 |
| org.scala-sbt:sbt | ≥ 0.3.4, < 1.9.7 | 1.9.7 |
| io | ≥ 1.0.0, < 1.9.7 | 1.9.7 |
| sbt | ≥ 0.3.4, < 1.9.7 | 1.9.7 |
Given specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. The follow is an example of a malicious entry:
+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys
This would have a potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks - https://github.com/search?q=IO.unzip+language%3AScala&type=code&l=Scala&p=1
The problem has been patched in https://github.com/sbt/io/pull/360 sbt 1.9.7 is available with the fix.
A workaround might be use some other library to unzip.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí