CVE-2021-32842

    Dashboard / Vulnerabilities / CVE-2021-32842

    CVE-2021-32842

    Published: 26 Jan 2022Last Modified: 8 Jul 2026

    Summary:

    Details: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability.

    References: https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3, https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fa75398a594b80a8945280ae8e7fb2cf1e7dfa70
    Fixed -1b1ab013ce1df02d8f27cf582197759c614d9126

    Affected versions

    v1.3.2
    v1.3.1
    v1.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High