With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be
    unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war"
    packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive
    containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write
    files to any location on the local fie system that the user executing Ivy has write access to. Ivy users
    of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1. (CVE-2022-37865)

The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (OpenSSL)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2023-2650)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Security)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2023-20862)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Commons FileUpload)). Supported versions that are affected are 8.0.34 and prior. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor.
    (CVE-2023-24998)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Tomcat)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2023-28709)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Ivy)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all MySQL Enterprise Monitor accessible data and unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor.
    (CVE-2022-37865)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-35f775fd6e advisory.

    **Changelog**     ```
    * Sun Jun 25 2023 Didik Supriadi <didiksupriadi41@fedoraproject.org> - 2.5.1-3
    - Build with ivy instead of maven     ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-174 advisory.

    A flaw was found in Apache Ivy. With Apache Ivy 2.4.0, an optional packaging attribute was introduced that     allows artifacts to be unpacked on the fly if pack200 or zip packaging was used. This issue could allow a     malicious user to have unwanted access. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.
    (CVE-2022-37865)

    When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a     user-supplied pattern that may include placeholders for artifacts coordinates like the organisation,     module or version. If said coordinates contain ../ sequences - which are valid characters for Ivy     coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or     repository or can overwrite different artifacts inside of the local cache. In order to exploit this     vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests     containing .. sequences and a normal repository will not interpret them as part of the artifact     coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1. (CVE-2022-37866)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
413032	SCA: security update for org.apache.ivy:ivy (GHSA-94rr-4jr5-9h2p)	Tenable Cloud Security	SCA Checks	critical
413032	SCA: security update for org.apache.ivy:ivy (GHSA-94rr-4jr5-9h2p)	Tenable Self-Hosted Container Security	SCA Checks	critical
178719	Oracle MySQL Enterprise Monitor (Jul 2023 CPU)	Nessus	CGI abuses	critical
177912	Fedora 38 : apache-ivy (2023-35f775fd6e)	Nessus	Fedora Local Security Checks	critical
175079	Amazon Linux 2023 : apache-ivy, apache-ivy-javadoc (ALAS2023-2023-174)	Nessus	Amazon Linux Local Security Checks	critical

Detections

Analytics

CVE-2022-37865

critical

Tenable Plugins

critical

critical

critical

critical

critical