A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr
    v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
    (CVE-2022-44900)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-7030-1 advisory.

    It was discovered that py7zr was vulnerable to path traversal attacks. If a user or automated system were     tricked into extracting a specially crafted 7z archive, an attacker could possibly use this issue to write     arbitrary files outside the target directory on the host.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5652 advisory.

  - A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr     v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
    (CVE-2022-44900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
416855	SCA: security update for py7zr (GHSA-m8xw-9x5x-6vh3)	Tenable Cloud Security	SCA Checks	critical
416855	SCA: security update for py7zr (GHSA-m8xw-9x5x-6vh3)	Tenable Self-Hosted Container Security	SCA Checks	critical
207695	Ubuntu 22.04 LTS : py7zr vulnerability (USN-7030-1)	Nessus	Ubuntu Local Security Checks	critical
192756	Debian dsa-5652 : python-py7zr-doc - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2022-44900

critical

Tenable Plugins

critical

critical

critical

critical