Log in Start free

Vulnerability · Published May 26, 2022 · Assigned by debian

CVE-2022-1664directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar

Critical 9.8

In plain English

A critical-severity security flaw in dpkg from Debian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.2%top 11.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20dpkg1.21.8-r0ALPINE-CVE-2022-1664
Alpine:v3.21dpkg1.21.8-r0ALPINE-CVE-2022-1664
Alpine:v3.22dpkg1.21.8-r0ALPINE-CVE-2022-1664
Alpine:v3.23dpkg1.21.8-r0ALPINE-CVE-2022-1664
Alpine:v3.24dpkg1.21.8-r0ALPINE-CVE-2022-1664
Debian:12dpkg1.21.8DEBIAN-CVE-2022-1664
Debian:13dpkg1.21.8DEBIAN-CVE-2022-1664
Debian:14dpkg1.21.8DEBIAN-CVE-2022-1664
Ubuntu:22.04:LTSdpkg1.21.1ubuntu2.1UBUNTU-CVE-2022-1664
Ubuntu:22.04:LTSdpkg1.21.1ubuntu2.1USN-5446-1

Affected products (as reported)

VendorProductVersions
Debian dpkg 1.14.17 – before 1.21.8

References