CVE-2023-46122
Low
Description
sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.
SeverityLow
CVSS3.9
Exploit probability—
ProductScala-sbt Io
PublishedOct 23, 2023
First seenOct 23, 2023
Weakness typeCWE-22Path traversal
How to fix
Update
- scala-sbt io1.9.7 or later
- scala-sbt sbt1.9.7 or later
- org.scala-sbt:sbt1.9.7 or later
- org.scala-sbt:io_2.121.9.7 or later
- org.scala-sbt:io_2.131.9.7 or later
- org.scala-sbt:io_31.9.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| scala-sbt io | 1.0.0 ≤ v < 1.9.7 | 1.9.7 |
| scala-sbt sbt | 0.3.4 ≤ v < 1.9.7 | 1.9.7 |
| org.scala-sbt:sbtMaven | 0.3.4 ≤ v < 1.9.7 | 1.9.7 |
| org.scala-sbt:io_2.12Maven | 1.0.0 ≤ v < 1.9.7 | 1.9.7 |
| org.scala-sbt:io_2.13Maven | 1.0.0 ≤ v < 1.9.7 | 1.9.7 |
| org.scala-sbt:io_3Maven | 1.0.0 ≤ v < 1.9.7 | 1.9.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.