Red Hat Security Advisory

RHSA-2018:1837

rh-maven33-plexus-archiver and rh-maven35-plexus-archiver security update

Released 2018-06-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-maven33-plexus-archiver-2.4.2-5.1.el6, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el6
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven33-plexus-archiver-2.4.2-5.1.el7, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el7, rh-maven35-plexus-archiver-3.4-4.1.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-maven33-plexus-archiver-2.4.2-5.1.el6, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el6
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-maven33-plexus-archiver-2.4.2-5.1.el7, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el7, rh-maven35-plexus-archiver-3.4-4.1.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven33-plexus-archiver-2.4.2-5.1.el7, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el7, rh-maven35-plexus-archiver-3.4-4.1.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven33-plexus-archiver-2.4.2-5.1.el7, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el7, rh-maven35-plexus-archiver-3.4-4.1.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-maven33-plexus-archiver-2.4.2-5.1.el6, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el6
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven33-plexus-archiver-2.4.2-5.1.el7, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el7, rh-maven35-plexus-archiver-3.4-4.1.el7 +1

Fixes 1 record

TI-2018-16132 CVE-2018-1002200 · GHSA-hcxq-x77q-3469

Path traversal in Codehaus plexus-archiver

LOW 38

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction.

CVSS 3.0MEDIUM 5.5 Local No auth User interaction EPSS 0.11579 Published 2018-07-25 Partial fix · 3.6.0 CWE-22