https://bugzilla.redhat.com/show_bug.cgi?id=1948752
Bug ID: 1948752 Summary: CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: decathorpe@gmail.com, hhorak@redhat.com, java-maint@redhat.com, java-maint-sig@lists.fedoraproject.org, java-sig-commits@lists.fedoraproject.org, jorton@redhat.com, kaycoth@redhat.com, mizdebsk@redhat.com, qe-baseos-apps@redhat.com, rhcs-maint@redhat.com, sgehwolf@redhat.com, SpikeFedora@gmail.com, stuart@gathman.org Target Milestone: --- Classification: Other
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
References:
https://www.openwall.com/lists/oss-security/2021/04/12/1 https://issues.apache.org/jira/browse/IO-556
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1948753
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
Paramvir jindal pjindal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |aboyko@redhat.com, | |aileenc@redhat.com, | |akoufoud@redhat.com, | |alazarot@redhat.com, | |almorale@redhat.com, | |anstephe@redhat.com, | |asoldano@redhat.com, | |atangrin@redhat.com, | |ataylor@redhat.com, | |avibelli@redhat.com, | |bbaranow@redhat.com, | |bgeorges@redhat.com, | |bmaxwell@redhat.com, | |brian.stansberry@redhat.com | |, cdewolf@redhat.com, | |chazlett@redhat.com, | |clement.escoffier@redhat.co | |m, dandread@redhat.com, | |darran.lofthouse@redhat.com | |, dkreling@redhat.com, | |dosoudil@redhat.com, | |drieden@redhat.com, | |eleandro@redhat.com, | |etirelli@redhat.com, | |fjuma@redhat.com, | |ggaughan@redhat.com, | |gmalinko@redhat.com, | |gsmet@redhat.com, | |gvarsami@redhat.com, | |hamadhan@redhat.com, | |ibek@redhat.com, | |iweiss@redhat.com, | |janstey@redhat.com, | |jcoleman@redhat.com, | |jochrist@redhat.com, | |jolee@redhat.com, | |jpallich@redhat.com, | |jperkins@redhat.com, | |jross@redhat.com, | |jschatte@redhat.com, | |jstastny@redhat.com, | |jwon@redhat.com, | |kconner@redhat.com, | |krathod@redhat.com, | |kverlaen@redhat.com, | |kwills@redhat.com, | |ldimaggi@redhat.com, | |lgao@redhat.com, | |loleary@redhat.com, | |lthon@redhat.com, | |mnovotny@redhat.com, | |msochure@redhat.com, | |msvehla@redhat.com, | |mszynkie@redhat.com, | |nwallace@redhat.com, | |pdrozd@redhat.com, | |peholase@redhat.com, | |pgallagh@redhat.com, | |pjindal@redhat.com, | |pmackay@redhat.com, | |probinso@redhat.com, | |rguimara@redhat.com, | |rrajasek@redhat.com, | |rruss@redhat.com, | |rstancel@redhat.com, | |rsvoboda@redhat.com, | |rwagner@redhat.com, | |sbiarozk@redhat.com, | |sdouglas@redhat.com, | |smaestri@redhat.com, | |spinder@redhat.com, | |sthorger@redhat.com, | |tcunning@redhat.com, | |theute@redhat.com, | |tkirby@redhat.com, | |tom.jenkinson@redhat.com, | |tzimanyi@redhat.com, | |yborgess@redhat.com
--- Comment #1 from Paramvir jindal pjindal@redhat.com --- Adding MW affects.
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
Paramvir jindal pjindal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1929333
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
Paramvir jindal pjindal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(krathod@redhat.co | |m)
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
Kunjan Rathod krathod@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(krathod@redhat.co | |m) |
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |apache-commons-io 2.7
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1954900, 1954902, 1954901, | |1954899, 1954898
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |swoodman@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
lnacshon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1969298
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #21 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Vert.x 4.1.0
Via RHSA-2021:2465 https://access.redhat.com/errata/RHSA-2021:2465
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:2465
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2021-07-07 10:40:19
--- Comment #22 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2021-29425
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #23 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat AMQ Streams 1.8.0
Via RHSA-2021:3225 https://access.redhat.com/errata/RHSA-2021:3225
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3225
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #24 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
EAP 7.3.9 release
Via RHSA-2021:3471 https://access.redhat.com/errata/RHSA-2021:3471
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3471
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #25 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8
Via RHSA-2021:3468 https://access.redhat.com/errata/RHSA-2021:3468
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3468
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #26 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6
Via RHSA-2021:3466 https://access.redhat.com/errata/RHSA-2021:3466
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3466
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #27 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
Via RHSA-2021:3467 https://access.redhat.com/errata/RHSA-2021:3467
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3467
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #28 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
Via RHSA-2021:3516 https://access.redhat.com/errata/RHSA-2021:3516
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3516
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #29 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.4.9
Via RHSA-2021:3534 https://access.redhat.com/errata/RHSA-2021:3534
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3534
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #30 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Via RHSA-2021:3656 https://access.redhat.com/errata/RHSA-2021:3656
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3656
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #31 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Via RHSA-2021:3658 https://access.redhat.com/errata/RHSA-2021:3658
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3658
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #32 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
EAP 7.4.1 release
Via RHSA-2021:3660 https://access.redhat.com/errata/RHSA-2021:3660
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3660
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #33 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat AMQ 7.9.0
Via RHSA-2021:3700 https://access.redhat.com/errata/RHSA-2021:3700
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3700
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #36 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.10
Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5134
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #37 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHPAM 7.12.1
Via RHSA-2022:1108 https://access.redhat.com/errata/RHSA-2022:1108
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1108
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #38 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHDM 7.12.1
Via RHSA-2022:1110 https://access.redhat.com/errata/RHSA-2022:1110
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1110
https://bugzilla.redhat.com/show_bug.cgi?id=1948752
--- Comment #40 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7
Via RHSA-2021:3660 https://access.redhat.com/errata/RHSA-2021:3660
java-sig-commits@lists.fedoraproject.org