Path traversal in sbt and io - CVE-2023-46122

Vulnerability identifier: #VU83435

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-46122

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can trick the victim to open a specially crafted zip or JAR file and overwrite arbitrary files on the system, such as /root/.ssh/authorized_keys, which can result in full system compromise.

sbt
io
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
openEuler
IBM Watson Knowledge Catalog in Cloud Pak for Data
sbt
sbt-bootstrap
maven-resolver-transport-wagon
maven-resolver-impl
maven-resolver-named-locks
maven-resolver
maven-resolver-spi
maven-resolver-util
maven-resolver-transport-file
maven-resolver-connector-basic
maven-resolver-test-util
maven-resolver-javadoc
maven-resolver-transport-http
maven-resolver-transport-classpath
maven-resolver-api
maven-javadoc
maven-lib
maven
xmvn-resolve
xmvn-mojo-javadoc
xmvn-install
xmvn-connector-javadoc
xmvn-subst
xmvn-parent
xmvn-tools-javadoc
xmvn-mojo
xmvn-connector
xmvn-minimal
xmvn-api
xmvn-core
xmvn
AMQ Streams

Install update from vendor's website.

sbt - update to 1.9.7
io - update to 1.9.7
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
sbt - update to 0.13.1-6
sbt-bootstrap - update to 0.13.18-150200.4.16.1
sbt - update to 0.13.18-150200.4.16.1
maven-resolver-transport-wagon - update to 1.9.15-150200.3.14.2
maven-resolver-impl - update to 1.9.15-150200.3.14.2
maven-resolver-named-locks - update to 1.9.15-150200.3.14.2
maven-resolver - update to 1.9.15-150200.3.14.2
maven-resolver-spi - update to 1.9.15-150200.3.14.2
maven-resolver-util - update to 1.9.15-150200.3.14.2
maven-resolver-transport-file - update to 1.9.15-150200.3.14.2
maven-resolver-connector-basic - update to 1.9.15-150200.3.14.2
maven-resolver-test-util - update to 1.9.15-150200.3.14.2
maven-resolver-javadoc - update to 1.9.15-150200.3.14.2
maven-resolver-transport-http - update to 1.9.15-150200.3.14.2
maven-resolver-transport-classpath - update to 1.9.15-150200.3.14.2
maven-resolver-api - update to 1.9.15-150200.3.14.2
AMQ Streams - update to 2.5.2
maven-javadoc - update to 3.9.4-150200.4.18.1
maven-lib - update to 3.9.4-150200.4.18.1
maven - update to 3.9.4-150200.4.18.1
xmvn-resolve - update to 4.2.0-150200.3.14.1
xmvn-mojo-javadoc - update to 4.2.0-150200.3.14.1
xmvn-install - update to 4.2.0-150200.3.14.1
xmvn-connector-javadoc - update to 4.2.0-150200.3.14.1
xmvn-subst - update to 4.2.0-150200.3.14.1
xmvn-parent - update to 4.2.0-150200.3.14.1
xmvn-tools-javadoc - update to 4.2.0-150200.3.14.1
xmvn-mojo - update to 4.2.0-150200.3.14.1
xmvn-connector - update to 4.2.0-150200.3.14.1
xmvn-minimal - update to 4.2.0-150200.3.14.1
xmvn-api - update to 4.2.0-150200.3.14.1
xmvn-core - update to 4.2.0-150200.3.14.1
xmvn - update to 4.2.0-150200.3.14.1

• https://github.com/sbt/io/issues/358
• https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf
• https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a
• https://github.com/sbt/io/pull/360

• Path traversal in Scala sbt and Scala io
• SUSE update for maven, maven-resolver, sbt, xmvn
• Multiple vulnerabilities in AMQ Streams 2.5
• openEuler update for sbt
• Multiple vulnerabilities in IBM Watson Knowledge Catalog