CVE-2025-23011
Fedora Repository archive extraction path traversal
Résumé
Fedora Repository archive extraction path traversal
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).
Références
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- package github.com
- web raw.githubusercontent.com