Arbitrary File Write Vulnerability in GNU gzip's zgrep Utility
Summary
CVE-2022-1271: An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. Affects gzip across 2 version ranges.
< 1.12-r0
< 2327a461e1afce862c22269b80d3517801103c1b
Fixed in 1.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU gzip is a popular compression utility used to compress and decompress files. It includes a utility called zgrep, which allows users to search for patterns within compressed files. The vulnerability affects the zgrep utility and can be exploited by an attacker to write arbitrary files on the system. This can lead to unauthorized access, data loss, or even remote code execution.
Vulnerability Detail
The vulnerability (CVE-2022-1271) arises due to insufficient validation when processing filenames with two or more newlines. An attacker can craft a multi-line file name with embedded content and target file names, tricking zgrep into overwriting arbitrary files with the attacker's chosen content. This can be exploited remotely by a low privileged attacker. The impact of this vulnerability is significant, as it allows an attacker to modify or delete sensitive files on the system.
How To Fix
Minimum fixed version
1.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade gzipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix and update the affected packages to mitigate the risk of exploitation.
Conclusion
The arbitrary file write vulnerability in GNU gzip's zgrep utility (CVE-2022-1271) poses a significant risk to systems running affected versions of gzip and xz in Alpine Linux. It allows an attacker to overwrite arbitrary files on the system, potentially leading to unauthorized access, data loss, or remote code execution. It is crucial to update the affected packages to the fixed versions to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gzip →
FAQ
This vulnerability allows an attacker to write arbitrary files on the system, potentially leading to unauthorized access, data loss, or remote code execution.
Yes, this vulnerability can be exploited remotely by a low privileged attacker.
No, there are no known workarounds for this vulnerability. It is essential to update the affected packages to the fixed versions.
The vulnerability affects the gzip and xz packages in Alpine Linux versions 3.12 to 3.18.
Users can update the affected packages using the package manager or by manually downloading and installing the updated packages from the official Alpine Linux repositories.
Related vulnerabilities
Recent vulnerabilities recorded for gzip.
