USN-7030-1: py7zr vulnerability

Releases

• Ubuntu 22.04 LTS

Packages

• py7zr - Pure Python 7-zip library

Details

It was discovered that py7zr was vulnerable to path traversal attacks.
If a user or automated system were tricked into extracting a specially
crafted 7z archive, an attacker could possibly use this issue to write
arbitrary files outside the target directory on the host.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• python3-py7zr - 0.11.3+dfsg-4ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-44900