cve-2022-37866
Vulnerability from cvelistv5
Published
2022-11-07 00:00
Modified
2024-08-03 10:37
Severity ?
Summary
When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing ".." sequences and a "normal" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.
References
security@apache.orghttps://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93bMailing List, Vendor Advisory
security@apache.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93bMailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/
Impacted products
Vendor Product Version
Apache Software Foundation Apache Ivy Version: 2.0.0   < unspecified
Version: unspecified   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:37:41.699Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93b",
               },
               {
                  name: "FEDORA-2023-35f775fd6e",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache Ivy",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     lessThan: "unspecified",
                     status: "affected",
                     version: "2.0.0",
                     versionType: "custom",
                  },
                  {
                     lessThanOrEqual: "2.5.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "This issue was discovered by Kostya Kortchinsky of the Databricks Security Team.",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied \"pattern\" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain \"../\" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing \"..\" sequences and a \"normal\" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     other: "medium",
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-04T00:00:00",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               url: "https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93b",
            },
            {
               name: "FEDORA-2023-35f775fd6e",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "Apache Ivy allows path traversal in the presence of a malicious repository",
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2022-37866",
      datePublished: "2022-11-07T00:00:00",
      dateReserved: "2022-08-08T00:00:00",
      dateUpdated: "2024-08-03T10:37:41.699Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:ivy:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.0.0\", \"versionEndExcluding\": \"2.5.1\", \"matchCriteriaId\": \"763540A0-083B-45AC-9C64-7E109FE0D21A\"}]}]}]",
         descriptions: "[{\"lang\": \"en\", \"value\": \"When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied \\\"pattern\\\" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain \\\"../\\\" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing \\\"..\\\" sequences and a \\\"normal\\\" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.\"}, {\"lang\": \"es\", \"value\": \"Cuando Apache Ivy descarga artefactos de un repositorio, los almacena en el sistema de archivos local seg\\u00fan un \\\"patr\\u00f3n\\\" proporcionado por el usuario que puede incluir marcadores de posici\\u00f3n para las coordenadas de los artefactos, como la organizaci\\u00f3n, el m\\u00f3dulo o la versi\\u00f3n. Si dichas coordenadas contienen secuencias \\\"../\\\", que son caracteres v\\u00e1lidos para las coordenadas de Ivy en general, es posible que los artefactos se almacenen fuera del cach\\u00e9 o repositorio local de Ivy o puedan sobrescribir diferentes artefactos dentro del cach\\u00e9 local. Para aprovechar esta vulnerabilidad, un atacante necesita la colaboraci\\u00f3n del repositorio remoto, ya que Ivy emitir\\u00e1 solicitudes http que contienen secuencias \\\"..\\\" y un repositorio \\\"normal\\\" no las interpretar\\u00e1 como parte de las coordenadas del artefacto. Los usuarios de Apache Ivy 2.0.0 a 2.5.1 deben actualizar a Ivy 2.5.1.\"}]",
         id: "CVE-2022-37866",
         lastModified: "2024-11-21T07:15:17.407",
         metrics: "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
         published: "2022-11-07T14:15:12.357",
         references: "[{\"url\": \"https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93b\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
         sourceIdentifier: "security@apache.org",
         vulnStatus: "Modified",
         weaknesses: "[{\"source\": \"security@apache.org\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2022-37866\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2022-11-07T14:15:12.357\",\"lastModified\":\"2024-11-21T07:15:17.407\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied \\\"pattern\\\" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain \\\"../\\\" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing \\\"..\\\" sequences and a \\\"normal\\\" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.\"},{\"lang\":\"es\",\"value\":\"Cuando Apache Ivy descarga artefactos de un repositorio, los almacena en el sistema de archivos local según un \\\"patrón\\\" proporcionado por el usuario que puede incluir marcadores de posición para las coordenadas de los artefactos, como la organización, el módulo o la versión. Si dichas coordenadas contienen secuencias \\\"../\\\", que son caracteres válidos para las coordenadas de Ivy en general, es posible que los artefactos se almacenen fuera del caché o repositorio local de Ivy o puedan sobrescribir diferentes artefactos dentro del caché local. Para aprovechar esta vulnerabilidad, un atacante necesita la colaboración del repositorio remoto, ya que Ivy emitirá solicitudes http que contienen secuencias \\\"..\\\" y un repositorio \\\"normal\\\" no las interpretará como parte de las coordenadas del artefacto. Los usuarios de Apache Ivy 2.0.0 a 2.5.1 deben actualizar a Ivy 2.5.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:ivy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.5.1\",\"matchCriteriaId\":\"763540A0-083B-45AC-9C64-7E109FE0D21A\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93b\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.