Red Hat Security Advisory

RHSA-2018:1836

plexus-archiver security update

Released 2018-06-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client Optional (v. 7) plexus-archiver-2.4.2-5.el7_5, plexus-archiver-javadoc-2.4.2-5.el7_5
Red Hat Enterprise Linux ComputeNode Optional (v. 7) plexus-archiver-2.4.2-5.el7_5, plexus-archiver-javadoc-2.4.2-5.el7_5
Red Hat Enterprise Linux Server Optional (v. 7) plexus-archiver-2.4.2-5.el7_5, plexus-archiver-javadoc-2.4.2-5.el7_5
Red Hat Enterprise Linux Workstation Optional (v. 7) plexus-archiver-2.4.2-5.el7_5, plexus-archiver-javadoc-2.4.2-5.el7_5
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) plexus-archiver-2.4.2-5.el7_5, plexus-archiver-javadoc-2.4.2-5.el7_5

Fixes 1 record

TI-2018-16132 CVE-2018-1002200 · GHSA-hcxq-x77q-3469

Path traversal in Codehaus plexus-archiver

LOW 38

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction.

CVSS 3.0MEDIUM 5.5 Local No auth User interaction EPSS 0.11579 Published 2018-07-25 Partial fix · 3.6.0 CWE-22