CVE-2022-1271 | gzip (CWE-1035)

[yeyisan]

A high severity vulnerability has been discovered in your project.

Project Name: Node

Scanner Name: trivy

Cwe ID: 1035

Cwe Name: Using Components with Known Vulnerabilities

Cwe Link: https://cwe.mitre.org/data/definitions/1035.html

CVE ID: CVE-2022-1271

Target: redis:latest (debian 11.3)

Packages:

• gzip : 1.10-4 - Fixed Version: 1.10-4+deb11u1

References:

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1271
• https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html
• https://ubuntu.com/security/notices/USN-5378-1
• https://ubuntu.com/security/notices/USN-5378-2
• https://ubuntu.com/security/notices/USN-5378-3
• https://ubuntu.com/security/notices/USN-5378-4
• https://www.openwall.com/lists/oss-security/2022/04/07/8

Tool Description: An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

Custom Description: hh