Arbitrary File Write Vulnerability in gzip Package
Summary
ALPINE-CVE-2022-1271: An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. Affects gzip versions < 1.12-r0. Fixed in 1.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gzip package is a widely used utility for file compression and decompression, primarily in Unix-like operating systems. It is known for its efficiency and speed in handling large files. However, a recent vulnerability has been identified in its zgrep utility, which can lead to severe security risks if exploited.
Vulnerability Detail
An arbitrary file write vulnerability was discovered in the zgrep utility of GNU gzip. This vulnerability arises from insufficient validation when processing filenames that contain two or more newlines. An attacker can exploit this flaw by crafting a filename that, when processed by zgrep, can overwrite arbitrary files on the system. This poses a significant risk as it allows a remote, low-privileged attacker to write malicious content to sensitive files, potentially leading to system compromise.
How To Fix
Minimum fixed version
1.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade gzipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the zgrep utility on files that may contain crafted filenames. Additionally, consider implementing strict input validation in your applications to prevent the processing of potentially malicious filenames.
Conclusion
The arbitrary file write vulnerability in the gzip package's zgrep utility poses a significant risk to systems running affected versions. It is crucial to update to the patched version to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can provide real-time alerts without the need for code access.
See every vulnerability recorded for gzip →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
This vulnerability affects various versions of the gzip package across multiple Alpine Linux releases, specifically versions prior to 1.12-r0.
Yes, a remote, low-privileged attacker can exploit this vulnerability to write arbitrary files on the system.
If immediate updates are not possible, implement strict input validation and avoid using the zgrep utility until a patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for gzip.
