Date: Mon, 12 Apr 2021 20:25:55 +0200 From: Jochen Wiedmann <jochen.wiedmann@...il.com> To: oss-security@...ts.openwall.com Subject: CVE-2021-29425 (Possible limited path traversal in Apache Commons IO 2.2 to 2.6) Hi, I'd like to inform you about a possible limited path traversal vulnerability, that has been detected in Apache Commons IO 2.2 to 2.6. This is now being tracked as CVE-2021-29425. Fortunately, this has already been covered in versions 2.7, and 2.8. On behalf of the Apache Commons team, Jochen Wiedmann Description: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value. This issue is being tracked as IO-556,IO-559 Mitigation: Neither the method in question (FileNameUtils.normalize) nor any methods, that invoke it, do actually access any files. There's only a string returned, from which a path can be constructed. In other words, a possible workaround would be not passing any unsafe input to FileNameUtils.normalize. Upgrade to Apache Commons IO 2.7, or later, where the same method returns the value null, as an indication of "invalid input". References: https://issues.apache.org/jira/browse/IO-556 -- Look, that's why there's rules, understand? So that you think before you break 'em. -- (Terry Pratchett, Thief of Time)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.