Описание
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libpf4j-java | fixed | 3.9.0+dfsg-2 | package | |
| libpf4j-java | ignored | bookworm | package |
Примечания
https://github.com/pf4j/pf4j/pull/537
https://github.com/pf4j/pf4j/pull/538
Fixed by: https://github.com/pf4j/pf4j/commit/8e0aa198c4e652cfc1eb9e05ca9b64397f67cc72
Связанные уязвимости
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.
pf4j vulnerable to remote code execution via expandIfZip method in the extract function