Lack of data validation - Path Traversal In rar
Description
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | =1:3.5.1-1 || =1:3.6.0-1 || =1:3.7.1-1 || =1:3.7.1-2 || =1:3.7b1-1 || =1:3.7b1-2 || =1:3.8.0-1 || =1:3.8.0-2 || =1:3.8b2-1 || =1:3.8b2-2 || =1:3.8b3-1 || =1:3.9.b2-1 || =1:3.9.b3-1 || =2.02-2 || =2.60-1 || =2.80-2 || =2:3.9.0-1 || =2:3.9.1-1 || =2:3.9.2-1 || =2:3.9.3-1 || =2:4.0.b2-1 || =2:4.0.b3-1 || =2:4.2.0+dfsg.1-0.1 || =2:4.2.0-1 || =2:5.2.1b2-1 || =2:5.3.b2-1 || =2:5.4.0+dfsg.1-0.1 || =2:5.4.0-1 || =2:5.5.0-1 || =2:5.5.0-1.1 || =2:6.11-0.1 || =3.30-2 || >=0 <2:6.20~b1-0.1 | 2:6.20~b1-0.1 | |
debian 12 | =1:3.5.1-1 || =1:3.6.0-1 || =1:3.7.1-1 || =1:3.7.1-2 || =1:3.7b1-1 || =1:3.7b1-2 || =1:3.8.0-1 || =1:3.8.0-2 || =1:3.8b2-1 || =1:3.8b2-2 || =1:3.8b3-1 || =1:3.9.b2-1 || =1:3.9.b3-1 || =2.02-2 || =2.60-1 || =2.80-2 || =2:3.9.0-1 || =2:3.9.1-1 || =2:3.9.2-1 || =2:3.9.3-1 || =2:4.0.b2-1 || =2:4.0.b3-1 || =2:4.2.0+dfsg.1-0.1 || =2:4.2.0-1 || =2:5.2.1b2-1 || =2:5.3.b2-1 || =2:5.4.0+dfsg.1-0.1 || =2:5.4.0-1 || =2:5.5.0-1 || =2:5.5.0-1.1 || =2:6.11-0.1 || =3.30-2 || >=0 <2:6.20~b1-0.1 | 2:6.20~b1-0.1 | |
debian 14 | =1:3.5.1-1 || =1:3.6.0-1 || =1:3.7.1-1 || =1:3.7.1-2 || =1:3.7b1-1 || =1:3.7b1-2 || =1:3.8.0-1 || =1:3.8.0-2 || =1:3.8b2-1 || =1:3.8b2-2 || =1:3.8b3-1 || =1:3.9.b2-1 || =1:3.9.b3-1 || =2.02-2 || =2.60-1 || =2.80-2 || =2:3.9.0-1 || =2:3.9.1-1 || =2:3.9.2-1 || =2:3.9.3-1 || =2:4.0.b2-1 || =2:4.0.b3-1 || =2:4.2.0+dfsg.1-0.1 || =2:4.2.0-1 || =2:5.2.1b2-1 || =2:5.3.b2-1 || =2:5.4.0+dfsg.1-0.1 || =2:5.4.0-1 || =2:5.5.0-1 || =2:5.5.0-1.1 || =2:6.11-0.1 || =3.30-2 || >=0 <2:6.20~b1-0.1 | 2:6.20~b1-0.1 | |
debian 12 | =1:3.5.2-0.1 || =1:3.5.2-0.2 || =1:3.5.4-0.1 || =1:3.5.4-1 || =1:3.5.4-1.1 || =1:3.7.2-1 || =1:3.7.3-1 || =1:3.7.3-1.1 || =1:3.7.8-1 || =1:3.7.8-2 || =1:3.8.2-1 || =1:3.8.4-1 || =1:3.8.5-1 || =1:3.8.5-2 || =1:3.9.10-1 || =1:3.9.3-1 || =1:3.9.5-1 || =1:3.9.6-1 || =1:3.9.7-1 || =1:3.9.9-1 || =1:4.0.2-1 || =1:4.0.3-1 || =1:4.1.4-1 || =1:4.2.4-0.1 || =1:4.2.4-0.2 || =1:4.2.4-0.3 || =1:5.0.10-1 || =1:5.2.5-1 || =1:5.2.7-0.1 || =1:5.3.2-1 || =1:5.4.5-1 || =1:5.5.5-1 || =1:5.5.8-1 || =1:5.6.6-1 || =1:5.6.6-2 || =1:5.9.4-1 || =1:6.0.3-1 || =1:6.0.4-1 || =1:6.0.4-2 || =1:6.0.5-1 || =1:6.0.6-1 || =1:6.0.7-1 || =1:6.0.7-2 || =1:6.0.7-3 || =1:6.0.7-4 || =1:6.0.7-5 || =1:6.0.7-6 || =1:6.1.2-1 || =1:6.1.3-1 || =1:6.1.3-2 || =1:6.1.4-1 || =1:6.1.5-1 || =1:6.1.6-1 || =1:6.1.6-2 || =1:6.1.6-3 || =3.3.6-2 || =3.3.6-2.0.1 || =3.4.3-1 || >=0 <1:6.1.7-1 | 1:6.1.7-1 | |
debian 13 | =1:3.5.2-0.1 || =1:3.5.2-0.2 || =1:3.5.4-0.1 || =1:3.5.4-1 || =1:3.5.4-1.1 || =1:3.7.2-1 || =1:3.7.3-1 || =1:3.7.3-1.1 || =1:3.7.8-1 || =1:3.7.8-2 || =1:3.8.2-1 || =1:3.8.4-1 || =1:3.8.5-1 || =1:3.8.5-2 || =1:3.9.10-1 || =1:3.9.3-1 || =1:3.9.5-1 || =1:3.9.6-1 || =1:3.9.7-1 || =1:3.9.9-1 || =1:4.0.2-1 || =1:4.0.3-1 || =1:4.1.4-1 || =1:4.2.4-0.1 || =1:4.2.4-0.2 || =1:4.2.4-0.3 || =1:5.0.10-1 || =1:5.2.5-1 || =1:5.2.7-0.1 || =1:5.3.2-1 || =1:5.4.5-1 || =1:5.5.5-1 || =1:5.5.8-1 || =1:5.6.6-1 || =1:5.6.6-2 || =1:5.9.4-1 || =1:6.0.3-1 || =1:6.0.4-1 || =1:6.0.4-2 || =1:6.0.5-1 || =1:6.0.6-1 || =1:6.0.7-1 || =1:6.0.7-2 || =1:6.0.7-3 || =1:6.0.7-4 || =1:6.0.7-5 || =1:6.0.7-6 || =1:6.1.2-1 || =1:6.1.3-1 || =1:6.1.3-2 || =1:6.1.4-1 || =1:6.1.5-1 || =1:6.1.6-1 || =1:6.1.6-2 || =1:6.1.6-3 || =3.3.6-2 || =3.3.6-2.0.1 || =3.4.3-1 || >=0 <1:6.1.7-1 | 1:6.1.7-1 | |
debian 14 | =1:3.5.2-0.1 || =1:3.5.2-0.2 || =1:3.5.4-0.1 || =1:3.5.4-1 || =1:3.5.4-1.1 || =1:3.7.2-1 || =1:3.7.3-1 || =1:3.7.3-1.1 || =1:3.7.8-1 || =1:3.7.8-2 || =1:3.8.2-1 || =1:3.8.4-1 || =1:3.8.5-1 || =1:3.8.5-2 || =1:3.9.10-1 || =1:3.9.3-1 || =1:3.9.5-1 || =1:3.9.6-1 || =1:3.9.7-1 || =1:3.9.9-1 || =1:4.0.2-1 || =1:4.0.3-1 || =1:4.1.4-1 || =1:4.2.4-0.1 || =1:4.2.4-0.2 || =1:4.2.4-0.3 || =1:5.0.10-1 || =1:5.2.5-1 || =1:5.2.7-0.1 || =1:5.3.2-1 || =1:5.4.5-1 || =1:5.5.5-1 || =1:5.5.8-1 || =1:5.6.6-1 || =1:5.6.6-2 || =1:5.9.4-1 || =1:6.0.3-1 || =1:6.0.4-1 || =1:6.0.4-2 || =1:6.0.5-1 || =1:6.0.6-1 || =1:6.0.7-1 || =1:6.0.7-2 || =1:6.0.7-3 || =1:6.0.7-4 || =1:6.0.7-5 || =1:6.0.7-6 || =1:6.1.2-1 || =1:6.1.3-1 || =1:6.1.3-2 || =1:6.1.4-1 || =1:6.1.5-1 || =1:6.1.6-1 || =1:6.1.6-2 || =1:6.1.6-3 || =3.3.6-2 || =3.3.6-2.0.1 || =3.4.3-1 || >=0 <1:6.1.7-1 | 1:6.1.7-1 |
Aliases
References
1. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-303332. https://github.com/TheL1ghtVn/CVE-2022-30333-PoC3. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/fileformat/unrar_cve_2022_30333.rb4. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_unrar_cve_2022_30333.rb
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.