~ / search / GHSA-gwrp-pvrq-jmwv

GHSA-gwrp-pvrq-jmwv

Path Traversal and Improper Input Validation in Apache Commons IO

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-29425

Packages

EcosystemPackageAffectedFixed in
Maven commons-io:commons-io < 2.7 2.7
Maven com.cosium.vet:vet >= 1.0, <= 3.22 no fix listed
Maven com.diamondq.common:common-thirdparty.jcasbin 1.4.0 no fix listed
Maven com.liferay:com.liferay.sass.compiler.jsass 1.0.1 no fix listed
Maven com.virjar:ratel-api >= 1.0.0, <= 1.3.6 no fix listed
Maven net.hasor:cobble-lang >= 4.4.1, <= 4.6.2 no fix listed
Maven org.apache.commons:commons-io 1.3.2 no fix listed
Maven org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io >= 1.4, <= 1.5 no fix listed
Maven org.checkerframework.annotatedlib:commons-io >= 2.6, < 2.7 2.7
Maven org.smartboot.servlet:servlet-core >= 0.1.9, <= 0.6 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

References

External links from the advisory. They lead to third-party sites.