Description
When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing ".." sequences and a "normal" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Ivy | 2.0.0 – < unspecified, unspecified – ≤ 2.5.0 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-ivy | 2.5.1-1.1 | openSUSE-SU-2024:12506-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | apache-ivy +1 | 2.5.1-1.amzn2023.0.1 | ALAS2023-2023-174 |
| Amazon Linux 2 | apache-ivy +1 | 2.3.0-4.amzn2.0.1 | ALAS2-2023-2165 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gradle-stage0 | 8.0.1-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.ivy:ivy | >= 2.0.0, < 2.5.1 | 2.5.1 | GHSA-wv7w-rj2x-556x |
Advisories 5
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-1142 Red Hat Integration Camel for Spring Boot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- openSUSE-SU-2024:12506-1 apache-ivy-2.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2023-2165 Important: apache-ivy security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 25, 2023
- ALAS2023-2023-174 Important: apache-ivy security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 3, 2023