Skip to content
OpenAdvisories
Medium ALAS2-2023-2059 1 CVE

Moderate: apache-commons-io security update (Amazon Linux 2)

Published May 25, 2023 · Updated Jun 1, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-29425: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 apache-commons-io 1:2.4-12.amzn2.0.1
Amazon Linux · 2 apache-commons-io-javadoc 1:2.4-12.amzn2.0.1

Vulnerabilities 1

  • Medium 6.5
    CVE-2021-29425 Public exploit EPSS 11%

    Possible limited path traversal vulnerabily in Apache Commons IO

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…

    Apache Software Foundation Apache Commons IO druid commons-io Debian Ubuntu Wolfi Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-29425.html