VDB
BDU%3A2024-02278
BDU%3A2024-02278
PUBLISHED
CVSS 9.399999618530273 CRITICAL
Уявимость пакетного менеджера Apache Ivy, связанная с неверным ограниченим имени пути к каталогу с ограниченным доступом, позволяющая нарушителю записать произвольные файлы в файловую систему
Risk Scores
CVSS 2.0
9.399999618530273
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat Inc., Novell Inc., ООО «Ред Софт», Fedora Project, JetBrains, Apache Software Foundation | Red Hat Enterprise Linux, Jboss Fuse, Red Hat Software Collections, openSUSE Tumbleweed, Red Hat JBoss Data Grid, SUSE Linux Enterprise Module for Development Tools, Red Hat Integration Camel K, РЕД ОС (запись в едином реестре российских программ №3751), OpenSUSE Leap, SUSE Linux Enterprise Server for SAP Applications, SUSE Manager Proxy, SUSE Manager Server, SUSE Enterprise Storage, SUSE Linux Enterprise High Performance Computing, SUSE Manager Retail Branch Server, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop, Fedora, Migration Toolkit for Applications, Migration Toolkit for Runtimes, Red Hat Integration Camel for Spring Boot, Red Hat JBoss Enterprise Application Platform, Scala Plugin for IntelliJ IDEA, Ivy |
Timeline
- Mar 25, 2024 CVE Published
- Dec 5, 2024 CVE Updated
References
- https://lists.apache.org/thread/gqvvv7qsm2dfjg6xzsw1s2h08tbr0sdy url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/ url
- https://access.redhat.com/security/cve/CVE-2022-37865 url
- https://www.suse.com/security/cve/CVE-2022-37865.html url
- https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-apache-ivy-cve-2022-37866-cve-2022-37865/?sphrase_id=592511 url