High ELSA-2018-1836 1 CVE

Important: plexus-archiver security update (Oracle Linux 7)

Published Jun 12, 2018 · Updated Jun 12, 2018

Ecosystem: Oracle Linux

Summary

[0:2.4.2-5]
- Fix arbitrary file write vulnerability
- Resolves: CVE-2018-1002200

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 7	plexus-archiver	0:2.4.2-5.el7_5
Oracle Linux · 7	plexus-archiver-javadoc	0:2.4.2-5.el7_5

Vulnerabilities 1

Medium 5.5

CVE-2018-1002200 Public exploit EPSS 12%

Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Codehaus plexus-archiver plexus-archiver org.codehaus.plexus:plexus-archiver Debian Ubuntu Maven

Jul 25, 2018