CVE - CVE-2022-1271

CVE-ID
CVE-2022-1271	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20220930-0006/ GENTOO:GLSA-202209-01 URL:https://security.gentoo.org/glsa/202209-01 MISC:https://access.redhat.com/security/cve/CVE-2022-1271 URL:https://access.redhat.com/security/cve/CVE-2022-1271 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=2073310 URL:https://bugzilla.redhat.com/show_bug.cgi?id=2073310 MISC:https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6 URL:https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6 MISC:https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html URL:https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html MISC:https://security-tracker.debian.org/tracker/CVE-2022-1271 URL:https://security-tracker.debian.org/tracker/CVE-2022-1271 MISC:https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch URL:https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch MISC:https://www.openwall.com/lists/oss-security/2022/04/07/8 URL:https://www.openwall.com/lists/oss-security/2022/04/07/8
Assigning CNA
Red Hat, Inc.
Date Record Created
20220407	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20220407)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)