CVE-2022-1664

Katalog CVE

CVSS 9.8 · Critical EPSS 3,2%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada debian dpkg, debian linux +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.

Rincian

Terbit di NVD

26 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495 mailing list · patch · advisory vendor
• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5 mailing list · patch · advisory vendor
• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200b mailing list · patch · advisory vendor
• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24be mailing list · patch · advisory vendor
• https://lists.debian.org/debian-lts-announce/2022/05/msg00033.html mailing list · advisory vendor
• https://lists.debian.org/debian-security-announce/2022/msg00115.html mailing list · advisory vendor
• https://security.netapp.com/advisory/ntap-20221007-0002/ advisory pihak ketiga