AZL-9853
Dashboard / Vulnerabilities / AZL-9853
Summary: CVE-2022-1664 affecting package dpkg for versions less than 1.20.10-1
Details: Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.
References: https://nvd.nist.gov/vuln/detail/CVE-2022-1664
Affected packages
Package
Name: dpkg
Purl: pkg:rpm/azure-linux/dpkg
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -1.20.10-1
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
