Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.codehaus.plexus:plexus-archiver

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1MavenPublished

    Arbitrary File Creation in AbstractUnArchiver

    CVE-2023-37460 · GHSA-wh3p-fphp-9h2m

    Affected
    • Maven org.codehaus.plexus:plexus-archiver < 4.8.0
    Fixed in
    4.8.0· Vendor fix available
    Issue
    Using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. Description When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the resolveFile() function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later Files.newOutputStream(), that follows symlinks by default, will actually write the entry's content to the symlink's target. Impact Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Technical Details In AbstractUnArchiver.java: When given an entry that already exists in dir as a symbolic link whose target does not exist - the symbolic link’s target will be created and the content of the archive’s entry will be…

    Recommended action: Upgrade to 4.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 5.5MavenPublished

    Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver

    CVE-2018-1002200 · GHSA-hcxq-x77q-3469

    Affected
    • Maven org.codehaus.plexus:plexus-archiver < 3.6.0
    Fixed in
    3.6.0· Vendor fix available
    Issue
    plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

    Recommended action: Upgrade to 3.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →