This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2022-30333 →
UBUNTU-CVE-2022-30333
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by c...
Original description
The description as published by the source.
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:16.04:LTS
libclamunrar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:16.04:LTS
rar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:16.04:LTS
unrar-nonfree
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
libclamunrar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
rar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
unrar-nonfree
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
libclamunrar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.11-0ubuntu0.20.04.1"}]}]
Ubuntu:20.04:LTS
rar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.23-1~20.04.1"}]}]
Ubuntu:20.04:LTS
unrar-nonfree
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.6-2ubuntu0.1"}]}]
Ubuntu:22.04:LTS
libclamunrar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.11-0ubuntu0.22.04.1"}]}]
Ubuntu:22.04:LTS
rar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.23-1~22.04.1"}]}]
Ubuntu:22.04:LTS
unrar-nonfree
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1.5-1ubuntu0.1"}]}]
Ubuntu:24.04:LTS
rar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.23-1"}]}]
References
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- report ubuntu.com
- report rarlab.com
- report rarlab.com
- report github.com
- report cve.org
- report cisa.gov