Vulnerability · Published Mar 1, 2021 · Assigned by apache
CVE-2020-9479unzip directory traversal
Medium 5.5
In plain English
A medium-severity security flaw in Apache AsterixDB from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)2.0%top 19.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache AsterixDB | Apache AsterixDB git |
References
- https://www.openwall.com/lists/oss-security/2020/08/08/2 x_refsource_MISC
- [asterixdb-dev] 20210301 Re: [EXT] Re: CVE Publication Service Request 941606 mailing-list, x_refsource_MLIST