Description
sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sbt | sbt | >= 0.3.4, < 1.9.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| SLES 15 SP5 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| SLES 15 SP5 | sbt +1 | 0.13.18-150200.4.16.1 | SUSE-SU-2023:4527-1 |
| SLES 15 SP5 | xmvn +3 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
| SLES 15 SP4 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| SLES 15 SP4 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| SLES 15 SP4 | xmvn +3 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
| SLES 15 SP3 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| SLES 15 SP3 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| SLES 15 SP3 | xmvn +3 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
| SLES 15 SP2 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| SLES 15 SP2 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| SLES 15 SP2 | xmvn +3 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| SLES for SAP 15 SP3 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| SLES for SAP 15 SP3 | xmvn +3 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
| SLES for SAP 15 SP2 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| SLES for SAP 15 SP2 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| SLES for SAP 15 SP2 | xmvn +3 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
| SLE HPC 15 SP3 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| SLE HPC 15 SP3 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| SLE HPC 15 SP3 | xmvn +3 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
| SLE HPC 15 SP2 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| SLE HPC 15 SP2 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| SLE HPC 15 SP2 | xmvn +3 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
| SUSE Enterprise Storage 7.1 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| SUSE Enterprise Storage 7.1 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| SUSE Enterprise Storage 7.1 | xmvn +3 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| openSUSE Leap 15.5 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| openSUSE Leap 15.5 | sbt +1 | 0.13.18-150200.4.16.1 | SUSE-SU-2023:4527-1 |
| openSUSE Leap 15.5 | xmvn +4 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
| openSUSE Leap 15.4 | maven | 3.9.4-150200.4.18.1 | SUSE-SU-2023:4527-1 |
| openSUSE Leap 15.4 | maven-resolver | 1.9.15-150200.3.14.2 | SUSE-SU-2023:4527-1 |
| openSUSE Leap 15.4 | sbt +1 | 0.13.18-150200.4.16.1 | SUSE-SU-2023:4527-1 |
| openSUSE Leap 15.4 | xmvn +4 | 4.2.0-150200.3.14.1 | SUSE-SU-2023:4527-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.scala-sbt:io_2.12 | >= 1.0.0, < 1.9.7 | 1.9.7 | GHSA-h9mw-grgx-2fhf |
| Maven | org.scala-sbt:io_2.13 | >= 1.0.0, < 1.9.7 | 1.9.7 | GHSA-h9mw-grgx-2fhf |
| Maven | org.scala-sbt:io_3 | >= 1.0.0, < 1.9.7 | 1.9.7 | GHSA-h9mw-grgx-2fhf |
| Maven | org.scala-sbt:sbt | >= 0.3.4, < 1.9.7 | 1.9.7 | GHSA-h9mw-grgx-2fhf |
Advisories 1
- SUSE-SU-2023:4527-1 Security update for maven, maven-resolver, sbt, xmvn SUSE / openSUSE Security Updates · Feb 4, 2026