CPANSA-Dpkg-2017-8283: Dpkg vulnerability

Publisher	giterlizzi	Document category	csaf_security_advisory
Initial release date	2017-04-26T00:00:00	Engine	CSAF Perl Toolkit 0.25
Current release date	2017-04-26T00:00:00	Build Date
Current version	1	Status	final
CVSS v3.1 Base Score	9.8	Severity	Critical
Original language		Language	en
Also referred to

Vulnerability Description

dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.

Vulnerabilities

CVE-2017-8283

Vulnerability Description

Weakness	CWE-22 : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Known affected

Product

Score

Dpkg less than 1.18.24

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
3.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	9.8	Critical
2.0	AV:N/AC:L/Au:N/C:P/I:P/A:P	7.5	High

Fixed

Dpkg greater than or equal 1.18.24

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

CPANSA-Dpkg-2017-8283 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2017/cpansa-dpkg-2017-8283.json
http://www.openwall.com/lists/oss-security/2017/04/20/2 external
http://www.openwall.com/lists/oss-security/2017/04/20/2
http://www.securityfocus.com/bid/98064 external
http://www.securityfocus.com/bid/98064
CVE-2017-8283 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2017-8283

Revision history

Version	Date of the revision	Summary of the revision
1	Wed Apr 26 00:00:00 2017	First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/