CVE-2022-35410

Name	CVE-2022-35410
Description	mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-5185-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mat2 (PTS)	bullseye (security), bullseye	0.12.1-2+deb11u1	fixed
	bookworm	0.13.3-1	fixed
	sid, trixie	0.13.4-2.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
mat2	source	buster	0.8.0-3+deb10u1	DSA-5185-1
mat2	source	bullseye	0.12.1-2+deb11u1	DSA-5185-1
mat2	source	(unstable)	0.13.0-1

Notes

https://0xacab.org/jvoisin/mat2/-/commit/beebca4bf1cd3b935824c966ce077e7bcf610385
https://0xacab.org/jvoisin/mat2/-/issues/174
https://dustri.org/b/mat2-0130.html