Lucene search
Redhat.comRH:CVE-2022-37865HistoryMar 27, 2023 - 8:43 p.m.
CVE-2022-37865
2023-03-2720:43:04
redhat.com
access.redhat.com
33
apache ivy
flaw
packaging attribute
artifacts
pack200
zip
malicious access
CVSS3
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS
0.001
Percentile
47.7%
A flaw was found in Apache Ivy. With Apache Ivy 2.4.0, an optional packaging attribute was introduced that allows artifacts to be unpacked on the fly if pack200 or zip packaging was used. This issue could allow a malicious used to have unwanted access.
Related
osv
osv
Apache Ivy does not verify target path when extracting the archive
2022-11-07 12:00:33
CVE-2022-37865
2022-11-07 11:15:10
apache-ivy-2.5.1-1.1 on GA media
2024-06-15 00:00:00
github
github
Apache Ivy does not verify target path when extracting the archive
2022-11-07 12:00:33
prion
prion
Code injection
2022-11-07 11:15:00
nvd
nvd
CVE-2022-37865
2022-11-07 11:15:10
cvelist
cvelist
CVE-2022-37865 Apache Ivy allows creating/overwriting any file on the system
2022-11-07 00:00:00
veracode
veracode
Arbitrary File Write
2022-11-08 03:35:02
cve
cve
CVE-2022-37865
2022-11-07 11:15:10
openvas
openvas
Fedora: Security Advisory for apache-ivy (FEDORA-2023-35f775fd6e)
2023-07-05 00:00:00
Mageia: Security Advisory (MGASA-2023-0216)
2023-07-10 00:00:00
ibm
ibm
nessus
nessus
Fedora 38 : apache-ivy (2023-35f775fd6e)
2023-07-04 00:00:00
Amazon Linux 2023 : apache-ivy, apache-ivy-javadoc (ALAS2023-2023-174)
2023-05-03 00:00:00
RHEL 7 : apache-ivy (Unpatched Vulnerability)
2024-05-11 00:00:00
mageia
mageia
Updated apache-ivy packages fix security vulnerability
2023-07-07 08:54:45
fedora
fedora
[SECURITY] Fedora 38 Update: apache-ivy-2.5.1-3.fc38
2023-07-04 01:34:09
redhat
redhat
oracle
oracle
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00
Oracle Critical Patch Update Advisory - April 2023
2023-04-18 00:00:00
CVSS3
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS
0.001
Percentile
47.7%
Related for RH:CVE-2022-37865