CVE-2022-1271: Tukaani XZ Utils xzgrep Argument Injection Remote Code Execution Vulnerability
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.
Other sources
GNU gzip could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of file name by the zgrep utility. By using a specially-crafted file name, an attacker could exploit this vulnerability to write arbitrary files or execute arbitrary code on the system.
— IBM
The following vulnerability was published for xz-utils and gzip The bug would result in arbitrary-file-write vulnerability
CVE-2022-1271[0]: | zgrep, xzgrep: arbitrary-file-write vulnerability
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-1271 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1271 [1] https://www.openwall.com/lists/oss-security/2022/04/07/8 [2] https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6 [3] https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-1271?
CVE-2022-1271 is a vulnerability in Tukaani XZ Utils that allows for remote code execution through argument injection in the xzgrep utility.
How does CVE-2022-1271 affect me?
If you are using Tukaani XZ Utils and running the xzgrep utility on an attacker-controlled file, this vulnerability could allow the attacker to overwrite content to an arbitrary file.
What is the severity of CVE-2022-1271?
CVE-2022-1271 has a severity rating of 8.8, which is classified as high.
How can I fix CVE-2022-1271?
To fix CVE-2022-1271, you should update Tukaani XZ Utils to the latest version available and apply any patches provided by the vendor.
Where can I find more information about CVE-2022-1271?
You can find more information about CVE-2022-1271 on the official CVE website or the vendor's security advisory page.