CVE-2022-1664

    Dashboard / Vulnerabilities / CVE-2022-1664

    CVE-2022-1664

    Published: 26 May 2022Last Modified: 12 Aug 2026

    Summary: directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar

    Details: Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.

    References: https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495, https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5, https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200b, https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24be, https://lists.debian.org/debian-lts-announce/2022/05/msg00033.html, https://lists.debian.org/debian-security-announce/2022/msg00115.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1664.json, https://nvd.nist.gov/vuln/detail/CVE-2022-1664, https://security.netapp.com/advisory/ntap-20221007-0002/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 47d2e9c479d6650e4980231606cd43c744e3c0c9
    Fixed -e195a9f2ffd547e332f8f148a4135f537a5e77e7

    Affected versions

    1.21.7
    1.21.6
    1.21.5
    1.21.4
    1.21.3
    1.21.2
    1.21.1
    1.21.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-1664 | CVE-DB