Vulnerability Name:

CVE-2022-1271 (CCN-223754)

Assigned:2022-04-07
Published:2022-04-07
Updated:2022-10-07
Summary:An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.
CVSS v3 Severity:7.1 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
6.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.7 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.1 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-20
CWE-1173)
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2022-1271

Source: MISC
Type: Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-1271

Source: CCN
Type: Red Hat Bugzilla - Bug 2073310
CVE-2022-1271 gzip: arbitrary-file-write vulnerability

Source: MISC
Type: Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2073310

Source: XF
Type: UNKNOWN
gnugzip-cve20221271-sec-bypass(223754)

Source: MISC
Type: Mailing List, Patch, Third Party Advisory
https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6

Source: CCN
Type: GNU Web site
bug#54772: gzip-1.12 released [stable]

Source: MISC
Type: Mailing List, Patch, Vendor Advisory
https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html

Source: CCN
Type: oss-sec Mailing List, Thu, 7 Apr 2022 23:29:03 +0200
Re: zgrep, xzgrep: arbitrary-file-write vulnerability

Source: MISC
Type: Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2022-1271

Source: GENTOO
Type: Third Party Advisory
GLSA-202209-01

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20220930-0006/

Source: MISC
Type: Patch, Third Party Advisory
https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch

Source: CCN
Type: IBM Security Bulletin 6589939 (MQ Operator)
IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from gzip, jackson-databind, libssh, gnutls, nettle and zlib

Source: CCN
Type: IBM Security Bulletin 6615221 (Robotic Process Automation for Cloud Pak)
Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Source: CCN
Type: IBM Security Bulletin 6622033 (Cloud Pak for Watson AIOps)
Multiple Vulnerabilities in Cloud Pak for Watson AIOPs

Source: CCN
Type: IBM Security Bulletin 6827929 (Voice Gateway)
Multiple Vulnerabilities in base image packages

Source: CCN
Type: IBM Security Bulletin 6829139 (Watson Speech Services Cartridge for Cloud Pak for Data)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security bypass in GNU Gzip (CVE-2022-1271)

Source: CCN
Type: IBM Security Bulletin 6831855 (QRadar SIEM)
IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6838291 (Cloud Pak for Security)
IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6840945 (QRadar Network Security)
IBM QRadar Network Security is affected by multiple vulnerabilities.

Source: CCN
Type: Mend Vulnerability Database
CVE-2022-1271

Source: MISC
Type: Mailing List, Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/04/07/8

Source: CCN
Type: Oracle CPUJul2022
Oracle Critical Patch Update Advisory - July 2022

Source: CCN
Type: ZDI-22-619
Tukaani XZ Utils xzgrep Argument Injection Remote Code Execution Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnu:gzip:*:*:*:*:*:*:*:* (Version < 1.12)

    • Configuration 2:
  • cpe:/a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:9:*:*:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:9::baseos:*:*:*:*:*

    • Configuration RedHat 10:
  • cpe:/a:redhat:enterprise_linux:9:*:*:*:*:*:*:*

    • Configuration RedHat 11:
  • cpe:/a:redhat:enterprise_linux:9::appstream:*:*:*:*:*

    • Configuration RedHat 12:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 13:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ibm:qradar_network_security:5.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_network_security:5.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:voice_gateway:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:voice_gateway:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:voice_gateway:1.0.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:voice_gateway:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:voice_gateway:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:voice_gateway:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:voice_gateway:1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:3027
    P
    		liblzma5-32bit-5.2.3-150000.4.7.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95094
    P
    		apache2-mod_apparmor-3.0.4-150400.3.4 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:3422
    P
    		perl-apparmor-3.0.4-150400.3.4 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94493
    P
    		apparmor-abstractions-3.0.4-150400.3.4 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:3464
    P
    		apache2-mod_apparmor-3.0.4-150400.3.4 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94657
    P
    		liblzma5-32bit-5.2.3-150000.4.7.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2863
    P
    		apparmor-abstractions-3.0.4-150400.3.4 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95052
    P
    		perl-apparmor-3.0.4-150400.3.4 on GA media (Moderate)
    2022-06-22
    oval:com.redhat.rhsa:def:20225052
    P
    		RHSA-2022:5052: xz security update (Important)
    2022-06-15
    oval:com.redhat.rhsa:def:20224991
    P
    		RHSA-2022:4991: xz security update (Important)
    2022-06-13
    oval:com.redhat.rhsa:def:20224940
    P
    		RHSA-2022:4940: xz security update (Important)
    2022-06-08
    oval:com.redhat.rhsa:def:20224582
    P
    		RHSA-2022:4582: gzip security update (Important)
    2022-05-17
    oval:com.redhat.rhsa:def:20222191
    P
    		RHSA-2022:2191: gzip security update (Important)
    2022-05-11
    oval:org.opensuse.security:def:42280
    P
    		Security update for gzip (Important)
    2022-05-10
    oval:org.opensuse.security:def:94443
    P
    		 (Important)
    2022-05-10
    oval:org.opensuse.security:def:93134
    P
    		 (Important)
    2022-05-10
    oval:org.opensuse.security:def:93452
    P
    		 (Important)
    2022-05-10
    oval:org.opensuse.security:def:93808
    P
    		 (Important)
    2022-05-10
    oval:org.opensuse.security:def:42182
    P
    		Security update for gzip (Important)
    2022-05-10
    oval:org.opensuse.security:def:885
    P
    		Security update for gzip (Important)
    2022-05-10
    oval:org.opensuse.security:def:95228
    P
    		Security update for gzip (Important)
    2022-05-10
    oval:org.opensuse.security:def:94234
    P
    		 (Important)
    2022-05-10
    oval:org.opensuse.security:def:42379
    P
    		Security update for gzip (Important)
    2022-05-10
    oval:org.opensuse.security:def:93294
    P
    		 (Important)
    2022-05-10
    oval:org.opensuse.security:def:475
    P
    		Security update for gzip (Important)
    2022-05-10
    oval:org.opensuse.security:def:93606
    P
    		 (Important)
    2022-05-10
    oval:org.opensuse.security:def:3598
    P
    		Security update for gzip (Important)
    2022-05-10
    oval:org.opensuse.security:def:94022
    P
    		 (Important)
    2022-05-10
    oval:com.redhat.rhsa:def:20221537
    P
    		RHSA-2022:1537: gzip security update (Important)
    2022-04-26
    oval:org.opensuse.security:def:93800
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:42173
    P
    		Security update for xz (Important)
    2022-04-12
    oval:org.opensuse.security:def:853
    P
    		Security update for xz (Important)
    2022-04-12
    oval:org.opensuse.security:def:100731
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:94226
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:42367
    P
    		Security update for xz (Important)
    2022-04-12
    oval:org.opensuse.security:def:99470
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:93290
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:101584
    P
    		Security update for xz (Important)
    2022-04-12
    oval:org.opensuse.security:def:93603
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:99732
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:94015
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:42264
    P
    		Security update for xz (Important)
    2022-04-12
    oval:org.opensuse.security:def:94437
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:93129
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:100398
    P
    		 (Important)
    2022-04-12
    oval:org.opensuse.security:def:93447
    P
    		 (Important)
    2022-04-12
    BACK
    gnu gzip *
    redhat jboss data grid 7.0.0
    debian debian linux 10.0
    ibm qradar network security 5.4.0
    ibm qradar network security 5.5.0
    ibm voice gateway 1.0.2
    ibm voice gateway 1.0.3
    ibm voice gateway 1.0.2.4
    ibm voice gateway 1.0.4
    ibm qradar security information and event manager 7.4 -
    ibm voice gateway 1.0.5
    ibm voice gateway 1.0.6
    ibm voice gateway 1.0.7
    ibm robotic process automation for cloud pak 21.0.1
    ibm robotic process automation for cloud pak 21.0.2
    ibm robotic process automation for cloud pak 21.0.3
    ibm cloud pak for security 1.10.0.0