A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/170127/py7zr-0.20.0-Directory-Traversal.html | Exploit Third Party Advisory VDB Entry |
https://github.com/miurahr/py7zr/commit/1bb43f17515c7f69673a1c88ab9cc72a7bbef406 | Patch Third Party Advisory |
https://lessonsec.com/cve/cve-2022-44900/ | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-12-06T00:00:00
Updated: 2022-12-07T00:00:00
Reserved: 2022-11-07T00:00:00
Link: CVE-2022-44900
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-12-06T20:15:10.560
Modified: 2022-12-09T14:28:53.127
Link: CVE-2022-44900
JSON object: View
Redhat Information
No data.
CWE