Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1102784 > unrolled thread

Bug#1010837: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1010837: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages Martin Meredith <mez@debian.org> - 2022-05-11 11:10 +0200
    Bug#1010837: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages Stefano Rivera <stefanor@debian.org> - 2022-05-11 23:50 +0200
      Bug#1010837: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages Martin Meredith <martin.meredith@substrakthealth.com> - 2022-05-12 14:20 +0200

#1102784 — Bug#1010837: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages

package: unrar
severity: grave
tags: security

---------- Forwarded Message ---------

From: Simon Scannell <simon.scannell@sonarsource.com>
Subject: CVE-2022-30333 (unrar file write vulnerability) patch not yet
available for Debian 10 packages
Date: May 11 2022, at 6:08 am
To: mez@debian.org
Cc: Vulnerability Research Team <vulnerability.research@sonarsource.com>


> Dear Martin,
> 
> I am contacting you as you are listed as the maintainer for the unrar
> package for Debian 10 as listed here: https://debian.pkgs.org/10/debian-nonfree-arm64/unrar_5.6.6-1_arm64.deb.html
> 
> We recently reported a vulnerability (CVE-2022-30333) to RarLab. It is
> a File Write vulnerability that allows an attacker to write a file
> outside of a target extraction dir when unarchiving an untrusted RAR
> archive. We have identified a high profile software that is affected
> by this vulnerability.
> 
> The vulnerability has been patched in RarLab's upstream version 6.12
> (https://www.rarlab.com/download.htm ).
> 
> If the changelog file is up to date, it seems like the package has not
> been updated yet, so no fix is available for users.
> 
> Please view this email as a friendly heads up about this issue. Once
> the package is updated, users can secure themselves.
> 
> Thank you,
> Simon Scannell | Sonar
> 
> Vulnerability Researcher
> Twitter: @scannell_simon
> https://sonarsource.com

[toc] | [next] | [standalone]

#1102845

Hi Martin (2022.05.11_06:47:38_-0400)
> fixed 1010837 1:6.1.2-1

Going from the security tracker:
https://security-tracker.debian.org/tracker/CVE-2022-30333

> 6.12 application version corresponds to 6.1.7 source version:
> https://github.com/debian-calibre/unrar-nonfree/compare/upstream/6.1.6...upstream/6.1.7


So, that should probably be fixed in 1:6.1.7-1, not 1:6.1.2-1

SR

-- 
Stefano Rivera
  http://tumbleweed.org.za/
  +1 415 683 3272

[toc] | [prev] | [next] | [standalone]

#1102892

notfixed 1010837 1:6.1.2-1
fixed 1010837 1:6.1.7-1
thanks

Thanks Stefano, I misread 6.12 as 6.1.2 - it's been a long week!

-- 
Kind regards, 
Martin

On May 11 2022, at 10:43 pm, Stefano Rivera <stefanor@debian.org> wrote:

> Hi Martin (2022.05.11_06:47:38_-0400)
>> fixed 1010837 1:6.1.2-1
> 
> Going from the security tracker:
> https://security-tracker.debian.org/tracker/CVE-2022-30333
> 
>> 6.12 application version corresponds to 6.1.7 source version:
>> https://github.com/debian-calibre/unrar-nonfree/compare/upstream/6.1.6...upstream/6.1.7
> 
> 
> So, that should probably be fixed in 1:6.1.7-1, not 1:6.1.2-1
> 
> SR
> 
> -- 
> Stefano Rivera
>  http://tumbleweed.org.za/
>  +1 415 683 3272
> 

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web