Vulnerability · Published Apr 13, 2021 · Assigned by apache
CVE-2021-29425Possible limited path traversal vulnerabily in Apache Commons IO
Medium 6.5
In plain English
A medium-severity improper input validation in Apache Commons IO from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.5% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)10.5%top 4.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | commons-io | 2.8.0-1 | DEBIAN-CVE-2021-29425 |
| Debian:13 | commons-io | 2.8.0-1 | DEBIAN-CVE-2021-29425 |
| Debian:14 | commons-io | 2.8.0-1 | DEBIAN-CVE-2021-29425 |
| Maven | com.cosium.vet:vet | no fix listed | GHSA-gwrp-pvrq-jmwv |
| Maven | com.diamondq.common:common-thirdparty.jcasbin | no fix listed | GHSA-gwrp-pvrq-jmwv |
| Maven | com.liferay:com.liferay.sass.compiler.jsass | no fix listed | GHSA-gwrp-pvrq-jmwv |
| Maven | com.virjar:ratel-api | no fix listed | GHSA-gwrp-pvrq-jmwv |
| Maven | commons-io:commons-io | 2.7 | GHSA-gwrp-pvrq-jmwv |
| Maven | net.hasor:cobble-lang | no fix listed | GHSA-gwrp-pvrq-jmwv |
| Maven | org.apache.commons:commons-io | no fix listed | GHSA-gwrp-pvrq-jmwv |
| Maven | org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io | no fix listed | GHSA-gwrp-pvrq-jmwv |
| Maven | org.checkerframework.annotatedlib:commons-io | 2.7 | GHSA-gwrp-pvrq-jmwv |
| Maven | org.smartboot.servlet:servlet-core | no fix listed | GHSA-gwrp-pvrq-jmwv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Commons IO | Apache Commons IO 2.2Apache Commons IO 2.3Apache Commons IO 2.4Apache Commons IO 2.5Apache Commons IO 2.6 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://issues.apache.org/jira/browse/IO-556 x_refsource_MISC
- https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E x_refsource_MISC
- [commons-dev] 20210414 Re: [all] OSS Fuzz mailing-list, x_refsource_MLIST
- [commons-dev] 20210415 Re: [all] OSS Fuzz mailing-list, x_refsource_MLIST
- [pulsar-commits] 20210420 [GitHub] [pulsar] lhotari opened a new pull request #10287: [Security] Upgrade commons-io to address CVE-2021-29425 mailing-list, x_refsource_MLIST
- [pulsar-commits] 20210420 [GitHub] [pulsar] merlimat merged pull request #10287: [Security] Upgrade commons-io to address CVE-2021-29425 mailing-list, x_refsource_MLIST
- [creadur-dev] 20210427 [jira] [Closed] (RAT-281) Update commons-io to fix CVE-2021-29425 Moderate severity mailing-list, x_refsource_MLIST
- [creadur-dev] 20210427 [jira] [Created] (RAT-281) Update commons-io to fix CVE-2021-29425 Moderate severity mailing-list, x_refsource_MLIST
- [creadur-dev] 20210427 [jira] [Commented] (RAT-281) Update commons-io to fix CVE-2021-29425 Moderate severity mailing-list, x_refsource_MLIST
- [creadur-dev] 20210427 [jira] [Updated] (RAT-281) Update commons-io to fix CVE-2021-29425 Moderate severity mailing-list, x_refsource_MLIST
- [pulsar-commits] 20210429 [pulsar] branch branch-2.7 updated: [Security] Upgrade commons-io to address CVE-2021-29425 (#10287) mailing-list, x_refsource_MLIST
- [myfaces-dev] 20210504 [GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #808: build: CVE fix mailing-list, x_refsource_MLIST
- [creadur-dev] 20210518 [jira] [Created] (WHISKER-19) Update commons-io to fix CVE-2021-29425 mailing-list, x_refsource_MLIST
- [creadur-dev] 20210518 [jira] [Commented] (WHISKER-19) Update commons-io to fix CVE-2021-29425 mailing-list, x_refsource_MLIST
- [creadur-dev] 20210518 [jira] [Assigned] (WHISKER-19) Update commons-io to fix CVE-2021-29425 mailing-list, x_refsource_MLIST
- [creadur-dev] 20210518 [jira] [Updated] (WHISKER-19) Update commons-io to fix CVE-2021-29425 mailing-list, x_refsource_MLIST
- [kafka-users] 20210617 vulnerabilities mailing-list, x_refsource_MLIST
- [creadur-dev] 20210621 [jira] [Commented] (RAT-281) Update commons-io to fix CVE-2021-29425 Moderate severity mailing-list, x_refsource_MLIST
- [commons-user] 20210709 commons-fileupload dependency and CVE mailing-list, x_refsource_MLIST
- [commons-user] 20210709 Re: commons-fileupload dependency and CVE mailing-list, x_refsource_MLIST
- [portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-789) Upgrade to commons-io-2.7 due to CVE-2021-29425 mailing-list, x_refsource_MLIST
- [portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-789) Upgrade to commons-io-2.7 due to CVE-2021-29425 mailing-list, x_refsource_MLIST
- [portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-789 Upgrade to commons-io-2.7 due to CVE-2021-29425 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20210805 [jira] [Updated] (ZOOKEEPER-4343) OWASP Dependency-Check fails with CVE-2021-29425, commons-io-2.6 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210805 [GitHub] [zookeeper] ztzg opened a new pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.7 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-dev] 20210805 [jira] [Created] (ZOOKEEPER-4343) OWASP Dependency-Check fails with CVE-2021-29425, commons-io-2.6 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210805 [GitHub] [zookeeper] ztzg commented on pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.7 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20210805 [jira] [Created] (ZOOKEEPER-4343) OWASP Dependency-Check fails with CVE-2021-29425, commons-io-2.6 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210806 [GitHub] [zookeeper] nkalmar commented on pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.7 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20210812 [SECURITY] [DLA 2741-1] commons-io security update mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210813 [GitHub] [zookeeper] ztzg commented on pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.11 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210813 [GitHub] [zookeeper] eolivelli commented on pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.11 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210813 [GitHub] [zookeeper] eolivelli commented on a change in pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.11 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210816 [GitHub] [zookeeper] nkalmar edited a comment on pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.11 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210816 [GitHub] [zookeeper] nkalmar commented on pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.11 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210825 [GitHub] [zookeeper] ztzg commented on pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.11 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210825 [GitHub] [zookeeper] ztzg commented on a change in pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.11 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210825 [GitHub] [zookeeper] eolivelli commented on pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.11 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210825 [GitHub] [zookeeper] ztzg edited a comment on pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.11 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20210901 [GitHub] [zookeeper] ztzg closed pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.11 (avoids CVE-2021-29425) mailing-list, x_refsource_MLIST