Описание
Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.
A flaw was found in Junrar, an open-source Java RAR archive library. A path traversal vulnerability in the LocalFolderExtractor allows a remote attacker to write arbitrary files with attacker-controlled content into sibling directories. This occurs when a specially crafted RAR archive is extracted, potentially leading to unauthorized file creation or modification outside the intended extraction path.
Меры по смягчению последствий
To mitigate this vulnerability, avoid processing RAR archives from untrusted sources. Restrict the extraction of RAR archives to only those originating from known and verified origins. This operational control reduces the risk of exploiting the path traversal flaw in Junrar by preventing the processing of malicious archives.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | junrar | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 8 | junrar | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | junrar | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
9.3 Critical
CVSS3
Связанные уязвимости
Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
EPSS
9.3 Critical
CVSS3