Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1002200: A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names. A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or vulnerable configurations. 1584392: CVE-2018-1002200 plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | plexus-archiver | 0:2.4.2-5.amzn2 |
| Amazon Linux · 2 | plexus-archiver-javadoc | 0:2.4.2-5.amzn2 |
Vulnerabilities 1
-
Medium 5.5
Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver
plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-1002200.html