CVE-2022-44900
Summary
| CVE | CVE-2022-44900 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-12-06 20:15:00 UTC |
|---|
| Updated | 2022-12-09 14:28:00 UTC |
|---|
| Description | A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Application |
Py7zr Project |
Py7zr |
All |
All |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| py7zr 0.20.0 Directory Traversal ≈ Packet Storm |
MISC |
packetstormsecurity.com |
|
| CVE-2022-44900: path traversal vulnerability in py7zr | less on sec |
MISC |
lessonsec.com |
|
| Fix sanity check for path traversal attack · miurahr/py7zr@1bb43f1 · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 183387 Debian Security Update for py7zr (CVE-2022-44900)
- 6000553 Debian Security Update for py7zr (DSA 5652-1)
