SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to     version 1.3.3, a check was added if the destination file is under destination directory. However, it is     not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like     `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory,     i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary     file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this     vulnerability. (CVE-2021-32841)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to
    version 1.3.3, a check was added if the destination file is under destination directory. However, it is
    not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like
    `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory,
    i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary
    file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this
    vulnerability. (CVE-2021-32841)

ID	Name	Product	Family	Severity
257795	Linux Distros Unpatched Vulnerability : CVE-2021-32841	Nessus	Misc.	medium
409160	SCA: security update for SharpZipLib (GHSA-2x7h-96h5-rq84)	Tenable Cloud Security	SCA Checks	medium
409160	SCA: security update for SharpZipLib (GHSA-2x7h-96h5-rq84)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2021-32841

medium

Tenable Plugins

medium

medium

medium