Input validation error in Gzip - CVE-2022-1271

Vulnerability identifier: #VU62002

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1271

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation when processing filenames with two or more newlines. A remote attacker can force zgrep or xzgrep to write arbitrary files on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.

Gzip
Amazon Linux AMI
Gentoo Linux
Arch Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server
CentOS
Anolis OS
HPE Helion Openstack
SUSE OpenStack Cloud
Red Hat Enterprise Linux for x86_64
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Oracle Linux
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
Oracle Solaris
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Slackware Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
openEuler
Fedora
Isolation Segment
VMware Tanzu Application Service for VMs
NetObserv Operator
Service Telemetry Framework
Cryostat
Red Hat Advanced Cluster Management for Kubernetes
Ansible Automation Platform
Red Hat Advanced Cluster Security for Kubernetes
Dell Secure Connect Gateway
OpenShift Logging
IBM Robotic Process Automation
IBM Observability with Instana
IBM MQ
Netcool Operations Insight
Custom Metrics Autoscaler Operator for Red Hat OpenShift
IBM Cloud Transformation Advisor
Red Hat OpenShift Dev Spaces
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Session Smart Router
Red Hat OpenStack
elfutils (Red Hat package)
gzip (Debian package)
imgbased (Red Hat package)
gzip (Red Hat package)
redhat-release-virtualization-host (Red Hat package)
redhat-virtualization-host (Red Hat package)
redhat-virtualization-host-productimg (Red Hat package)
xz-utils (Debian package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
gzip
gzip (Ubuntu package)
gzip-debuginfo
gzip-debugsource
gzip-help
app-arch/gzip
ovirt-node-ng (Red Hat package)
xz-debugsource
xz-debuginfo
liblzma5-32bit
xz-lang
xz
liblzma5
liblzma5-debuginfo-32bit
xz-devel
liblzma5-debuginfo
xz-utils (Ubuntu package)
xz-compat-libs
xz-libs
xz-lzma-compat
xz (Red Hat package)
xz-static-devel
liblzma5-32bit-debuginfo
xz-devel-32bit
app-arch/xz-utils
xz-help
cflinuxfs3
Tanzu Greenplum for Kubernetes
EMC ECS
IBM Cloud Pak for Watson AIOps
Platform Automation Toolkit
Watson Studio on Cloud Pak for Data
XtremIO X2
Dell Data Protection Central
OpenShift API for Data Protection (OADP)
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
Red Hat OpenShift GitOps
IBM QRadar Network Security
OpenShift sandboxed containers
OpenShift Service Mesh
VMware Tanzu Operations Manager
Red Hat Virtualization
OpenShift Virtualization
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM Supplied MQ Advanced Queue Manager Container images
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
IBM Edge Application Manager
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
Red Hat Virtualization Host
Dell EMC NetWorker vProxy
OpenShift Developer Tools and Services
XZ Utils
IBM Security Guardium
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Unified Data Repository
Dell EMC VxRail Appliance

Install updates from vendor's website.

Gzip - update to 1.12
Isolation Segment - addressed in versions 2.7.44, 2.10.24, 2.11.13, 2.12.7
VMware Tanzu Application Service for VMs - addressed in versions 2.7.49, 2.10.31, 2.11.19, 2.12.12, 2.13.4
NetObserv Operator - update to 1.1.0
elfutils (Red Hat package) - update to 0.186-1.el8
cflinuxfs3 - update to 0.285.0
OpenShift API for Data Protection (OADP) - addressed in versions 1.0.4, 1.1.0
Tanzu Greenplum for Kubernetes - update to 2.0.0
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.0.1
gzip (Debian package) - addressed in versions 1.9-3+deb10u1, 1.10-4+deb11u1
imgbased (Red Hat package) - update to 1.2.24-1.el8ev
Red Hat OpenShift GitOps - update to 1.5
OpenShift sandboxed containers - update to 1.4.1
Migration Toolkit for Containers - addressed in versions 1.6.5, 1.7.1, 1.7.2, 1.7.3, 1.7.4
gzip (Red Hat package) - addressed in versions 1.5-11.el7_9, 1.9-10.el8_1, 1.9-10.el8_2, 1.9-13.el8_4, 1.9-13.el8_5, 1.10-9.el9_0
Cloud Pak for Security (CP4S) - update to 1.10.7.0
Cryostat - update to 2.1.0
OpenShift Service Mesh - addressed in versions 2.1.3, 2.4.8, 2.5.2
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.3.10, 2.3.11, 2.4.4, 2.4.5, 2.5.1
VMware Tanzu Operations Manager - addressed in versions 2.9.38, 2.10.39
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 3.68.2, 3.69.2, 3.70, 3.70.1
Red Hat OpenShift Container Platform - addressed in versions 3.11.705, 3.11.784, 4.6.58, 4.7.51, 4.8.41, 4.9.35, 4.11.0, 4.11.45, 4.13.0
Dell EMC NetWorker vProxy - update to 4.3.0-32
redhat-release-virtualization-host (Red Hat package) - addressed in versions 4.3.23-1.el7ev, 4.5.0-5.el8ev
redhat-virtualization-host (Red Hat package) - update to 4.3.23-20220622.0.el7_9
redhat-virtualization-host-productimg (Red Hat package) - addressed in versions 4.3.23-1.el7, 4.5.0-2.el8
OpenShift Virtualization - addressed in versions 4.8.7, 4.9.6, 4.10.2, 4.11.0
Dell Secure Connect Gateway - update to 5.12.00.10
OpenShift Logging - addressed in versions 5.2.10, 5.2.13, 5.3.7, 5.3.10, 5.4.1, 5.4.3
xz-utils (Debian package) - addressed in versions 5.2.4-1+deb10u1, 5.2.5-2.1~deb11u1
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 6, 7.5.0 Update Pack 3
IBM Robotic Process Automation - update to 21.0.3.1
IBM Observability with Instana - update to 1.0.295
IBM MQ - addressed in versions 1.3.4 EUS, 1.8.2 CD
gzip - addressed in versions 1.5-11, 1.9-13
gzip (Ubuntu package) - addressed in versions 1.6-5ubuntu1.2, 1.10-0ubuntu4.1, 1.10-4ubuntu1.1, 1.64ubuntu1+esm1
Netcool Operations Insight - update to 1.6.8
gzip - addressed in versions 1.6-9.9.1, 1.10-4.14.1, 1.10-150000.4.12.1, 1.10-150000.4.15.1, 1.10-150200.10.1
gzip-debuginfo - addressed in versions 1.6-9.9.1, 1.10-4.14.1, 1.10-150000.4.12.1, 1.10-150000.4.15.1, 1.10-150200.10.1
gzip-debugsource - addressed in versions 1.6-9.9.1, 1.10-4.14.1, 1.10-150000.4.12.1, 1.10-150000.4.15.1, 1.10-150200.10.1
gzip-debuginfo - update to 1.10-3
gzip - update to 1.10-3
gzip-debugsource - update to 1.10-3
gzip-help - update to 1.10-3
gzip - update to 1.10-5
gzip - addressed in versions 1.10-5.fc34, 1.10-6.fc35, 1.11-3.fc36
app-arch/gzip - update to 1.12
Multicluster Engine for Kubernetes - update to 2.5.8
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-376
EMC ECS - update to 3.7.0.3
IBM Cloud Transformation Advisor - update to 3.10.0
Red Hat OpenShift Dev Spaces - addressed in versions 3.15.0, 3.16.0, 3.17.0
IBM Cloud Pak for Watson AIOps - update to 4.2.0
ovirt-node-ng (Red Hat package) - update to 4.4.2-1.el8ev
Platform Automation Toolkit - addressed in versions 4.4.29, 5.0.22
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.3
Watson Studio on Cloud Pak for Data - addressed in versions 4.8.7, 5.1.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
xz-debugsource - addressed in versions 5.0.3-0.12.7.1, 5.0.5-6.7.1, 5.2.3-150000.4.7.1
xz-debuginfo - addressed in versions 5.0.3-0.12.7.1, 5.0.5-6.7.1, 5.2.3-150000.4.7.1
liblzma5-32bit - addressed in versions 5.0.3-0.12.7.1, 5.0.5-6.7.1, 5.2.3-150000.4.7.1
xz-lang - addressed in versions 5.0.3-0.12.7.1, 5.0.5-6.7.1, 5.2.3-150000.4.7.1
xz - addressed in versions 5.0.3-0.12.7.1, 5.0.5-6.7.1, 5.2.3-150000.4.7.1
liblzma5 - addressed in versions 5.0.3-0.12.7.1, 5.0.5-6.7.1, 5.2.3-150000.4.7.1
liblzma5-debuginfo-32bit - update to 5.0.5-6.7.1
xz-devel - addressed in versions 5.0.5-6.7.1, 5.2.3-150000.4.7.1
liblzma5-debuginfo - addressed in versions 5.0.5-6.7.1, 5.2.3-150000.4.7.1
xz-utils (Ubuntu package) - addressed in versions 5.1.1 alpha+201206142ubuntu2.16.04.1+esm1, 5.2.2-1.3ubuntu0.1, 5.2.4-1ubuntu1.1, 5.2.5-2ubuntu0.1
xz - addressed in versions 5.2.2-2, 5.2.4-4
xz-compat-libs - update to 5.2.2-2
xz-devel - addressed in versions 5.2.2-2, 5.2.4-4
xz-libs - addressed in versions 5.2.2-2, 5.2.4-4
xz-lzma-compat - update to 5.2.2-2
xz (Red Hat package) - addressed in versions 5.2.2-2.el7_9, 5.2.4-4.el8_1, 5.2.4-4.el8_2, 5.2.4-4.el8_4, 5.2.4-4.el8_6, 5.2.5-8.el9_0
xz-static-devel - update to 5.2.3-150000.4.7.1
liblzma5-32bit-debuginfo - update to 5.2.3-150000.4.7.1
xz-devel-32bit - update to 5.2.3-150000.4.7.1
app-arch/xz-utils - update to 5.2.5
xz-debuginfo - update to 5.2.5-2
xz - update to 5.2.5-2
xz-help - update to 5.2.5-2
xz-lzma-compat - update to 5.2.5-2
xz-libs - update to 5.2.5-2
xz-devel - update to 5.2.5-2
xz-debugsource - update to 5.2.5-2
xz - update to 5.2.5-9
xz - update to 5.2.5-9.fc36
IBM QRadar Network Security - addressed in versions 5.4.0.17, 5.5.0.12
Session Smart Router - addressed in versions 5.4.7, 5.5.3
XtremIO X2 - update to 6.4.2-13
Dell EMC VxRail Appliance - addressed in versions 7.0.372, 8.0.000
IBM Supplied MQ Advanced Queue Manager Container images - addressed in versions 9.2.0.5-r2-eus, 9.2.5.0-r3
Red Hat OpenStack - addressed in versions 16.2, 16.2.z
Dell Data Protection Central - update to 19.7.0-9

• https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148b7bd3c147a81ea00c7c
• https://savannah.gnu.org/forum/forum.php?forum_id=10157
• https://www.zerodayinitiative.com/advisories/ZDI-22-619/

• Remote code execution in GNU gzip
• Remote code execution in xzgrep from XZ Utils
• Arch Linux update for gzip
• Arch Linux update for xz
• Ubuntu update for xz-utils
• Ubuntu update for gzip
• Ubuntu update for gzip
• Ubuntu update for xz-utils
• Cloud Foundry Foundation cflinuxfs3 update for Gzip
• Slackware Linux update for gzip
• Slackware Linux update for xz
• Debian update for gzip
• Debian update for xz-utils
• Red Hat Enterprise Linux 8 update for gzip
• Red Hat Enterprise Linux 8.2 update for gzip
• Red Hat Enterprise Linux 8.4 update for gzip
• Red Hat Enterprise Linux 7 update for gzip
• Multiple vulnerabilities in Red Hat OpenShift Logging
• CentOS 7 update for gzip
• Multiple vulnerabilities in Cryostat
• Multiple vulnerabilities in OpenShift Container Platform 4.6
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in OpenShift Container Platform release 4.7
• Multiple vulnerabilities in OpenShift Container Platform 4.6
• Multiple vulnerabilities in OpenShift Container Platform 3.11
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes
• Multiple vulnerabilities in Red Hat Virtualization 4 for RHEL 8
• Amazon Linux AMI update for xz
• Amazon Linux AMI update for gzip
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for xz
• Red Hat Enterprise Linux 8.4 Extended Update Support update for xz
• Red Hat Enterprise Linux 8.2 Extended Update Support update for xz
• Red Hat Enterprise Linux 8.6 update for xz
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.1
• Multiple vulnerabilities in OpenShift Virtualization 4.10
• Red Hat Enterprise Linux 7 update for xz
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.4
• Red Hat Enterprise Linux 9 update for xz
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.3
• Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 update for redhat-release-virtualization-host and redhat-virtualization-host
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in OpenShift Developer Tools and Services
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.5
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.4
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Solaris
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenStack 16.2
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• VMware Tanzu products update for XZ Utils
• VMware Tanzu products update for Gzip
• Multiple vulnerabilities in Secondary Scheduler Operator for Red Hat OpenShift
• CentOS 7 update for xz
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Openshift Logging 5.3
• Multiple vulnerabilities in Openshift Logging 5.2
• Multiple vulnerabilities in Red Hat Service Telemetry Framework
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP)
• Gentoo update for GNU Gzip, XZ Utils
• Multiple vulnerabilities in OpenShift Container Platform 3.11
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.0
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in Dell EMC NetWorker vProxy
• Multiple vulnerabilities in OpenShift Virtualization
• Multiple vulnerabilities in Dell ECS
• Multiple vulnerabilities in OpenShift Virtualization 4.9
• Multiple vulnerabilities in Dell VxRail
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in Juniper Networks Session Smart Router
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM QRadar Network Security
• Multiple vulnerabilities in Dell VxRail Appliance components
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Input validation error in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for gzip
• Red Hat Enterprise Linux 9 update for gzip
• Multiple vulnerabilities in NetObserv Operator
• SUSE update for xz
• SUSE update for xz
• SUSE update for xz
• SUSE update for gzip
• SUSE update for gzip
• SUSE update for gzip
• SUSE update for gzip
• SUSE update for gzip
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• VMware Tanzu products update for Gzip
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in OpenShift sandboxed containers 1.4
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• openEuler update for gzip
• openEuler update for xz
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Amazon Linux AMI update for xz
• Amazon Linux AMI update for gzip
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.17
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabilities in Migration Toolkit for Containers 1.7
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Migration Toolkit for Containers 1.6
• Fedora 34 update for gzip
• Fedora 36 update for gzip
• Fedora 35 update for gzip
• Fedora 36 update for xz
• Multiple vulnerabilities in Dell XtremIO X2
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.5
• Multiple vulnerabilities in IBM Watson Studio on Cloud Pak for Data
• Anolis OS update for gzip
• Anolis OS update for gzip
• Anolis OS update for xz
• Anolis OS update for xz
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in IBM Edge Application Manager