CVE-2022-44900

Description

A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.

How to fix CVE-2022-44900

To remediate CVE-2022-44900, upgrade the affected package to a fixed version below.

• Debian/py7zr—upgrade to 0.11.3+dfsg-1+deb11u1 or later
• —upgrade to 0.11.3+dfsg-1+deb11u1 or later
• —upgrade to 0.20.1 or later
• —upgrade to 1bb43f17515c7f69673a1c88ab9cc72a7bbef406 or later

Is CVE-2022-44900 being exploited?

Moderate — EPSS is 25.0%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (4)

• from 0, < 0.11.3+dfsg-1+deb11u1
• from 0, < 0.11.3+dfsg-1+deb11u1
• from 0, < 0.20.1
• from 0, < 1bb43f17515c7f69673a1c88ab9cc72a7bbef406 | from 0, < 0.20.1

CVSS scores

References (10)

• ADVISORYgithub.com/advisories/GHSA-m8xw-9x5x-6vh3
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-44900
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-44900
• PATCHgithub.com/miurahr/py7zr
• WEB