Headline
Ubuntu Security Notice USN-7030-1
Ubuntu Security Notice 7030-1 - It was discovered that py7zr was vulnerable to path traversal attacks. If a user or automated system were tricked into extracting a specially crafted 7z archive, an attacker could possibly use this issue to write arbitrary files outside the target directory on the host.
==========================================================================Ubuntu Security Notice USN-7030-1September 24, 2024py7zr vulnerability==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 22.04 LTSSummary:py7zr could be made to create arbitrary files when extracting the contentsof a specially crafted 7z archive.Software Description:- py7zr: Pure Python 7-zip libraryDetails:It was discovered that py7zr was vulnerable to path traversal attacks.If a user or automated system were tricked into extracting a speciallycrafted 7z archive, an attacker could possibly use this issue to writearbitrary files outside the target directory on the host.Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 22.04 LTS python3-py7zr 0.11.3+dfsg-4ubuntu0.1In general, a standard system update will make all the necessary changes.References: https://ubuntu.com/security/notices/USN-7030-1 CVE-2022-44900Package Information: https://launchpad.net/ubuntu/+source/py7zr/0.11.3+dfsg-4ubuntu0.1Related news
Debian Linux Security Advisory 5652-1 - A directory traversal vulnerability was discovered in py7zr, a library and command-line utility to process 7zip archives.
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr versions 0.20.0 and earlier allows attackers to read arbitrary files on the local machine via a malicious 7z file extraction.
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.