High ELSA-2023-6886 1 CVE

Important: plexus-archiver security update (Oracle Linux 7)

Published Nov 13, 2023 · Updated Nov 13, 2023

Ecosystem: Oracle Linux

Summary

[0:2.4.2-6]
- Avoid override target symlink by standard file in AbstractUnArchiver
- Fixes: CVE-2023-37460

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 7	plexus-archiver	0:2.4.2-6.el7_9
Oracle Linux · 7	plexus-archiver-javadoc	0:2.4.2-6.el7_9

Vulnerabilities 1

High 8.1

CVE-2023-37460 Public exploit

Plexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiver

Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file c…

codehaus-plexus plexus-archiver javapackages-bootstrap org.codehaus.plexus:plexus-archiver Ubuntu Azure Linux Maven

Jul 25, 2023