Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1102784

Bug#1010837: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages

Show all headers | View raw

package: unrar
severity: grave
tags: security

---------- Forwarded Message ---------

From: Simon Scannell <simon.scannell@sonarsource.com>
Subject: CVE-2022-30333 (unrar file write vulnerability) patch not yet
available for Debian 10 packages
Date: May 11 2022, at 6:08 am
To: mez@debian.org
Cc: Vulnerability Research Team <vulnerability.research@sonarsource.com>


> Dear Martin,
> 
> I am contacting you as you are listed as the maintainer for the unrar
> package for Debian 10 as listed here: https://debian.pkgs.org/10/debian-nonfree-arm64/unrar_5.6.6-1_arm64.deb.html
> 
> We recently reported a vulnerability (CVE-2022-30333) to RarLab. It is
> a File Write vulnerability that allows an attacker to write a file
> outside of a target extraction dir when unarchiving an untrusted RAR
> archive. We have identified a high profile software that is affected
> by this vulnerability.
> 
> The vulnerability has been patched in RarLab's upstream version 6.12
> (https://www.rarlab.com/download.htm ).
> 
> If the changelog file is up to date, it seems like the package has not
> been updated yet, so no fix is available for users.
> 
> Please view this email as a friendly heads up about this issue. Once
> the package is updated, users can secure themselves.
> 
> Thank you,
> Simon Scannell | Sonar
> 
> Vulnerability Researcher
> Twitter: @scannell_simon
> https://sonarsource.com

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1010837: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages Martin Meredith <mez@debian.org> - 2022-05-11 11:10 +0200
  Bug#1010837: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages Stefano Rivera <stefanor@debian.org> - 2022-05-11 23:50 +0200
    Bug#1010837: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages Martin Meredith <martin.meredith@substrakthealth.com> - 2022-05-12 14:20 +0200

csiph-web