CVE-2016-1000031
FileUpload: DiskFileItem file manipulation
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (media).
Descripción
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | commons-fileupload:commons-fileupload | 1.3.3 |
| debian 11 | libcommons-fileupload-java | sin corrección indicada |
| debian 12 | libcommons-fileupload-java | sin corrección indicada |
| debian 13 | libcommons-fileupload-java | sin corrección indicada |
| debian 14 | libcommons-fileupload-java | sin corrección indicada |
| echo | libcommons-fileupload-java | sin corrección indicada |
| rapidfort debian 12 | libcommons-fileupload-java | sin corrección indicada |
| rapidfort debian 13 | libcommons-fileupload-java | sin corrección indicada |
| seal maven::Seal Security Database | commons-fileupload:commons-fileupload, seal.sp1.commons-fileupload:commons-fileupload | 1.2+sp999 |
Mostrar las 10 entradas de 9 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | commons-fileupload:commons-fileupload | 1.3.3 |
| debian 11 | libcommons-fileupload-java | sin corrección indicada |
| debian 12 | libcommons-fileupload-java | sin corrección indicada |
| debian 13 | libcommons-fileupload-java | sin corrección indicada |
| debian 14 | libcommons-fileupload-java | sin corrección indicada |
| echo | libcommons-fileupload-java | sin corrección indicada |
| rapidfort debian 12 | libcommons-fileupload-java | sin corrección indicada |
| rapidfort debian 13 | libcommons-fileupload-java | sin corrección indicada |
| seal maven::Seal Security Database | commons-fileupload:commons-fileupload | 1.2+sp999 |
| seal maven::Seal Security Database | seal.sp1.commons-fileupload:commons-fileupload | 1.2+sp999 |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/93604
- http://www.tenable.com/security/research/tra-2016-12
- http://www.zerodayinitiative.com/advisories/ZDI-16-570
- http://www.zerodayinitiative.com/advisories/ZDI-16-570/
- https://access.redhat.com/security/cve/CVE-2016-1000031
- https://github.com/advisories/GHSA-7x9j-7223-rg5m
Las 31 referencias
- https://issues.apache.org/jira/browse/FILEUPLOAD-279
- https://issues.apache.org/jira/browse/WW-4812
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000031
- https://security.netapp.com/advisory/ntap-20190212-0001
- https://security.netapp.com/advisory/ntap-20190212-0001/
- https://www.cve.org/CVERecord?id=CVE-2016-1000031
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.tenable.com/security/research/tra-2016-12
- https://www.tenable.com/security/research/tra-2016-23
- https://www.tenable.com/security/research/tra-2016-30