CVE-2021-32840

Description

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

1.545

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-32842,CVE-2021-32841,CVE-2021-32840 are fixed in Nuget - SharpZipLib 1.3.3	Windows
Vulnerabilities CVE-2021-32842,CVE-2021-32841,CVE-2021-32840 are fixed in Nuget - SharpZipLib for Linux 1.3.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234