CVE-2022-35410

NameCVE-2022-35410
Descriptionmat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5185-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mat2 (PTS)buster, buster (security)0.8.0-3+deb10u1fixed
bullseye (security), bullseye0.12.1-2+deb11u1fixed
bookworm, sid0.13.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mat2sourcebuster0.8.0-3+deb10u1DSA-5185-1
mat2sourcebullseye0.12.1-2+deb11u1DSA-5185-1
mat2source(unstable)0.13.0-1

Notes

https://0xacab.org/jvoisin/mat2/-/commit/beebca4bf1cd3b935824c966ce077e7bcf610385
https://0xacab.org/jvoisin/mat2/-/issues/174
https://dustri.org/b/mat2-0130.html
Search for package or bug name: Reporting problems