CGA-68m9-w8hc-8h64

Published

Last updated

https://images.chainguard.dev/security/CGA-68m9-w8hc-8h64

Package

hadoop-fips-3.3.6

Repository

Chainguard

Latest Update

Fix not planned

Aliases

CVE-2018-1002200
GHSA-hcxq-x77q-3469

Severity

Unknown

Summary

Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver

Description

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-1002200
https://github.com/advisories/GHSA-hcxq-x77q-3469
https://github.com/codehaus-plexus/plexus-archiver/pull/87
https://github.com/codehaus-plexus/plexus-archiver/commit/f8f4233508193b70df33759ae9dc6154d69c2ea8
https://access.redhat.com/errata/RHSA-2018:1836
https://access.redhat.com/errata/RHSA-2018:1837
https://github.com/codehaus-plexus/plexus-archiver
https://github.com/snyk/zip-slip-vulnerability
https://snyk.io/research/zip-slip-vulnerability
https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680
https://www.debian.org/security/2018/dsa-4227

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

Safe Source for Open Source™

Media Kit Contact Us

Private Policy

CGA-68m9-w8hc-8h64

Severity

Summary

Description

References

Updates

Products

Why Chainguard

Customers

Company

Resources