oss-sec mailing list archives
CVE-2021-29425 (Possible limited path traversal in Apache Commons IO 2.2 to 2.6)
From: Jochen Wiedmann <jochen.wiedmann () gmail com>
Date: Mon, 12 Apr 2021 20:25:55 +0200
Hi, I'd like to inform you about a possible limited path traversal vulnerability, that has been detected in Apache Commons IO 2.2 to 2.6. This is now being tracked as CVE-2021-29425. Fortunately, this has already been covered in versions 2.7, and 2.8. On behalf of the Apache Commons team, Jochen Wiedmann Description: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value. This issue is being tracked as IO-556,IO-559 Mitigation: Neither the method in question (FileNameUtils.normalize) nor any methods, that invoke it, do actually access any files. There's only a string returned, from which a path can be constructed. In other words, a possible workaround would be not passing any unsafe input to FileNameUtils.normalize. Upgrade to Apache Commons IO 2.7, or later, where the same method returns the value null, as an indication of "invalid input". References: https://issues.apache.org/jira/browse/IO-556 -- Look, that's why there's rules, understand? So that you think before you break 'em. -- (Terry Pratchett, Thief of Time)
Current thread:
- CVE-2021-29425 (Possible limited path traversal in Apache Commons IO 2.2 to 2.6) Jochen Wiedmann (Apr 12)