vulnwire
8.2high

CVE-2019-10185

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file.

Published 7 y ago · modified 4 mo ago · JSON

CVSS
8.2
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
4.0%
percentile 91%
Public exploits
0
none known

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.

Exploit prediction (EPSS)

4.02% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.08.2CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
NVD3.18.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CNA3.08.2CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
NVD2.06.4AV:N/AC:L/Au:N/C:N/I:P/A:P

Affected products

  • IcedTea icedtea-web

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

  • github.com /AdoptOpenJDK/IcedTea-Web/pull/344 · x_refsource_CONFIRM, x_transferred
  • github.com /AdoptOpenJDK/IcedTea-Web/issues/327 · x_refsource_CONFIRM, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10185 · x_refsource_CONFIRM, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2019-08/msg00045.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.debian.org /debian-lts-announce/2019/09/msg00008.html · mailing-list, x_refsource_MLIST, x_transferred
  • seclists.org /bugtraq/2019/Oct/5 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • packetstormsecurity.com /files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html · x_refsource_MISC, x_transferred
  • security.gentoo.org /glsa/202107-51 · vendor-advisory, x_refsource_GENTOO, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.