https://bugzilla.redhat.com/show_bug.cgi?id=1584388
--- Comment #3 from Doran Moppert <dmoppert(a)redhat.com> ---
Statement:
This is not a true vulnerability in apache-commons-compress, but a risk for
software using apache-commons-compress to extract archives. Malicious archives
can include absolute paths or relative paths including "../" that can cause
naive extractors to create or overwrite files outside the destination
directory.
Software that may be vulnerable can be identified by its use of
org.apache.commons.compress to read archives (usually via *InputStream objects)
and extract their contents to disk. Prior to creating any file, its path must
be fully normalized and checked to ensure it lies within the intended
destination directory. An example of a vulnerable usage and a suitable fix can
be found in bug 1584392 (plexus-archiver). Further care must be taken if the
extractor supports filesystem objects other than directories and files: for
example, hard links, symbolic links, device nodes and even sparse files can
present further security risks.
Red Hat Product Security has examined the following users of
apache-commons-compress and believes them to be safe:
* ovirt-engine: notaffected: reads archives, does not create files
* tika: notaffected: reads archives, does not create files
* apache-rat: notaffected: reads archives, does not create files
* eclipse-jgit: notaffected: does not read archives
--
You are receiving this mail because:
You are on the CC list for the bug.