CVE-2022-1664
Critical
Description
Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Debian Dpkg
PublishedMay 26, 2022
First seenMay 26, 2022
How to fix
Update
- debian dpkg1.18.26, 1.19.8, 1.20.10, 1.21.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian dpkg | 1.14.17 ≤ v < 1.18.26, 1.19.0 ≤ v < 1.19.8, 1.20.0 ≤ v < 1.20.10, 1.21.0 ≤ v < 1.21.8 | 1.18.26, 1.19.8, 1.20.10, 1.21.8 |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| netapp ontap_select_deploy_administration_utility | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.