CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages

Debian Bug report logs - #1010837
CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Martin Meredith <mez@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages

Date: Wed, 11 May 2022 10:03:34 +0100

package: unrar
severity: grave
tags: security

---------- Forwarded Message ---------

From: Simon Scannell <simon.scannell@sonarsource.com>
Subject: CVE-2022-30333 (unrar file write vulnerability) patch not yet
available for Debian 10 packages
Date: May 11 2022, at 6:08 am
To: mez@debian.org
Cc: Vulnerability Research Team <vulnerability.research@sonarsource.com>


> Dear Martin,
> 
> I am contacting you as you are listed as the maintainer for the unrar
> package for Debian 10 as listed here: https://debian.pkgs.org/10/debian-nonfree-arm64/unrar_5.6.6-1_arm64.deb.html
> 
> We recently reported a vulnerability (CVE-2022-30333) to RarLab. It is
> a File Write vulnerability that allows an attacker to write a file
> outside of a target extraction dir when unarchiving an untrusted RAR
> archive. We have identified a high profile software that is affected
> by this vulnerability.
> 
> The vulnerability has been patched in RarLab's upstream version 6.12
> (https://www.rarlab.com/download.htm ).
> 
> If the changelog file is up to date, it seems like the package has not
> been updated yet, so no fix is available for users.
> 
> Please view this email as a friendly heads up about this issue. Once
> the package is updated, users can secure themselves.
> 
> Thank you,
> Simon Scannell | Sonar
> 
> Vulnerability Researcher
> Twitter: @scannell_simon
> https://sonarsource.com

Message #20 received at 1010837@bugs.debian.org (full text, mbox, reply):

From: Stefano Rivera <stefanor@debian.org>

To: Martin Meredith <martin.meredith@substrakthealth.com>

Cc: 1010837@bugs.debian.org

Subject: Re: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages

Date: Wed, 11 May 2022 17:43:20 -0400

Hi Martin (2022.05.11_06:47:38_-0400)
> fixed 1010837 1:6.1.2-1

Going from the security tracker:
https://security-tracker.debian.org/tracker/CVE-2022-30333

> 6.12 application version corresponds to 6.1.7 source version:
> https://github.com/debian-calibre/unrar-nonfree/compare/upstream/6.1.6...upstream/6.1.7


So, that should probably be fixed in 1:6.1.7-1, not 1:6.1.2-1

SR

-- 
Stefano Rivera
  http://tumbleweed.org.za/
  +1 415 683 3272

Message #25 received at 1010837@bugs.debian.org (full text, mbox, reply):

From: Martin Meredith <martin.meredith@substrakthealth.com>

To: Stefano Rivera <stefanor@debian.org>, "control@bugs.debian.org" <control@bugs.debian.org>

Cc: "1010837@bugs.debian.org" <1010837@bugs.debian.org>

Subject: Re: CVE-2022-30333 (unrar file write vulnerability) patch not yet available for Debian 10 packages

Date: Thu, 12 May 2022 13:08:39 +0100

notfixed 1010837 1:6.1.2-1
fixed 1010837 1:6.1.7-1
thanks

Thanks Stefano, I misread 6.12 as 6.1.2 - it's been a long week!

-- 
Kind regards, 
Martin

On May 11 2022, at 10:43 pm, Stefano Rivera <stefanor@debian.org> wrote:

> Hi Martin (2022.05.11_06:47:38_-0400)
>> fixed 1010837 1:6.1.2-1
> 
> Going from the security tracker:
> https://security-tracker.debian.org/tracker/CVE-2022-30333
> 
>> 6.12 application version corresponds to 6.1.7 source version:
>> https://github.com/debian-calibre/unrar-nonfree/compare/upstream/6.1.6...upstream/6.1.7
> 
> 
> So, that should probably be fixed in 1:6.1.7-1, not 1:6.1.2-1
> 
> SR
> 
> -- 
> Stefano Rivera
>  http://tumbleweed.org.za/
>  +1 415 683 3272
> 

Send a report that this bug log contains spam.