CVE-2021-29425

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Apache commons IO library is used for developing IO functionality. It contains a collecton of utilities with utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

Security Fix(es):

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like //../foo , or .. foo , the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus limited path traversal), if the calling code would use the result to construct a path value.(CVE-2021-29425)

Red Hat Lightwell has released commons-io:commons-io 2.2.0.rhlw-00004 with backported fixes for CVE-2021-29425 and CVE-2024-47554.

CVE-2021-29425: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

CVE-2024-47554: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

This patched artifact is a drop-in replacement for commons-io:commons-io 2.2.0 from Maven Central.

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.5-tuxcare.2.

TuxCare rebuilt commons-digester:commons-digester to address 4 CVEs. Fixed in 2.1-tuxcare.1.

TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.4-tuxcare.2.

TuxCare rebuilt commons-io:commons-io to address 2 CVEs. Fixed in 2.2-tuxcare.1.

TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.6-tuxcare.2.

TuxCare rebuilt commons-io:commons-io to address 2 CVEs. Fixed in 2.1-tuxcare.1.

TuxCare rebuilt commons-io:commons-io to address 2 CVEs. Fixed in 2.3-tuxcare.1.

This update for apache-commons-io fixes the following issues:

• CVE-2021-29425: Limited path traversal when invoking the method FileNameUtils.normalize with an improper input string (bsc#1184755)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the apache-commons-io-2.11.0-2.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2021-29425 in the io.root.commons-io:commons-io package for Root:Maven. Multiple fixed versions available.

This update for apache-commons-io fixes the following issues:

• CVE-2021-29425: Limited path traversal when invoking the method FileNameUtils.normalize with an improper input string (bsc#1184755)

This update for apache-commons-io fixes the following issues:

• CVE-2021-29425: Limited path traversal when invoking the method FileNameUtils.normalize with an improper input string (bsc#1184755).

It was discovered that Apache Commons IO incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information.