Security update for apache-commons-io SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:1282-1 Final 1 1 2021-04-20T12:47:20Z current 2021-04-20T12:47:20Z 2021-04-20T12:47:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apache-commons-io This update for apache-commons-io fixes the following issues: - CVE-2021-29425: Limited path traversal when invoking the method FileNameUtils.normalize with an improper input string (bsc#1184755) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/openjdk-devel:11-2021-1282,Container bci/openjdk-devel:latest-2021-1282,Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure-2021-1282,Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM-2021-1282,Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE-2021-1282,Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2021-1282,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2021-1282,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2021-1282,Image SLES15-SP4-Manager-Server-4-3-BYOS-2021-1282,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2021-1282,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2021-1282,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2021-1282,SUSE-2021-1282,SUSE-SLE-Module-Basesystem-15-SP2-2021-1282 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20211282-1/ Link for SUSE-SU-2021:1282-1 https://lists.suse.com/pipermail/sle-security-updates/2021-April/008666.html E-Mail link for SUSE-SU-2021:1282-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1184755 SUSE Bug 1184755 https://www.suse.com/security/cve/CVE-2021-29425/ SUSE CVE CVE-2021-29425 page Container bci/openjdk-devel:11 Container bci/openjdk-devel:latest Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE SUSE Linux Enterprise Module for Basesystem 15 SP2 apache-commons-io-2.6-3.3.1 apache-commons-io-javadoc-2.6-3.3.1 apache-commons-io-2.6-3.3.1 as a component of Container bci/openjdk-devel:11 apache-commons-io-2.6-3.3.1 as a component of Container bci/openjdk-devel:latest apache-commons-io-2.6-3.3.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure apache-commons-io-2.6-3.3.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM apache-commons-io-2.6-3.3.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE apache-commons-io-2.6-3.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure apache-commons-io-2.6-3.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM apache-commons-io-2.6-3.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE apache-commons-io-2.6-3.3.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS apache-commons-io-2.6-3.3.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure apache-commons-io-2.6-3.3.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 apache-commons-io-2.6-3.3.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE apache-commons-io-2.6-3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value. CVE-2021-29425 Container bci/openjdk-devel:11:apache-commons-io-2.6-3.3.1 Container bci/openjdk-devel:latest:apache-commons-io-2.6-3.3.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:apache-commons-io-2.6-3.3.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:apache-commons-io-2.6-3.3.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:apache-commons-io-2.6-3.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:apache-commons-io-2.6-3.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:apache-commons-io-2.6-3.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:apache-commons-io-2.6-3.3.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:apache-commons-io-2.6-3.3.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:apache-commons-io-2.6-3.3.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:apache-commons-io-2.6-3.3.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:apache-commons-io-2.6-3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:apache-commons-io-2.6-3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211282-1/ https://www.suse.com/security/cve/CVE-2021-29425.html CVE-2021-29425 https://bugzilla.suse.com/1184755 SUSE Bug 1184755