Headline
CVE-2023-37460: Release 4.8.0 · codehaus-plexus/plexus-archiver
Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified Archiver/UnArchiver API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the resolveFile() function will return the symlink’s source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later Files.newOutputStream(), that follows symlinks by default, will actually write the entry’s content to the symlink’s target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue.
🚀 New features and improvements
- Add tzst alias for tar.zst archiver/unarchived (#274) @slawekjaranowski
🐛 Bug Fixes
- detect permissions for addFile (#293) @hboutemy
📦 Dependency updates
- Bump org.codehaus.plexus:plexus from 13 to 14 (#296) @dependabot
- Bump zstd-jni from 1.5.5-4 to 1.5.5-5 (#295) @dependabot
- Bump Eclipse Sisu and from 0.3.5 to 0.9.0.M2 (#289) @slachiewicz
- Bump commons-io from 2.12.0 to 2.13.0 (#288) @dependabot
- Bump zstd-jni from 1.5.5-3 to 1.5.5-4 (#287) @dependabot
- Bump plexus-utils from 3.5.1 to 4.0.0 (#283) @dependabot
- Bump commons-io from 2.11.0 to 2.12.0 (#277) @dependabot
- Bump zstd-jni from 1.5.5-2 to 1.5.5-3 (#284) @dependabot
- Bump guice from 5.1.0 to 6.0.0 (#278) @dependabot
- Bump plexus from 10 to 13 (#280) @dependabot
👻 Maintenance
- Remove public modifier from JUnit 5 tests (#294) @slawekjaranowski
- Use https in scm/url (#291) @slawekjaranowski
- Remove junit-jupiter-engine from project dependencies (#292) @slawekjaranowski
- Remove parent and reports menu from site (#282) @slawekjaranowski
- Cleanup after “veryLargeJar” test (#281) @slachiewicz
- Override project.url (#279) @slawekjaranowski
Related news
Red Hat Security Advisory 2023-6886-01 - An update for plexus-archiver is now available for Red Hat Enterprise Linux 7.
### Summary Using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. ### Description When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the resolveFile() function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later Files.newOutputStream(), that follows symlinks by default, will actually write the entry's content to the symlink's target. ### Impact Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. ### Technical Details In [AbstractUnArchiver.java](https://github.com/codehaus-plexus/plexus-archiver/blob/plexus-archiver-4.7.1/src/main/java/org/codehaus/plexus/archiver/AbstractUnArchiver.java#L342): ```java protecte...