{"id":"CVE-2023-46122","aliases":["EUVD-2023-2746","GHSA-h9mw-grgx-2fhf","OESA-2024-2422","SUSE-SU-2023:4527-1"],"status":"published","title":"Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt","description":"sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00369,"percentile":0.31182,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-10-23T15:51:02Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Maven","package":"org.scala-sbt:sbt","fixed_in":["1.9.7"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.scala-sbt:io_2.12","fixed_in":["1.9.7"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.scala-sbt:io_2.13","fixed_in":["1.9.7"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.scala-sbt:io_3","fixed_in":["1.9.7"],"sources":["ghsa","osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"sbt","fixed_in":["0.13.1-6.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"sbt","fixed_in":["0.13.1-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"sbt","fixed_in":["0.13.1-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"sbt","fixed_in":["0.13.1-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"sbt","fixed_in":["0.13.1-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"sbt","fixed_in":["0.13.18-150200.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"sbt-bootstrap","fixed_in":["0.13.18-150200.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"sbt","fixed_in":["0.13.18-150200.4.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"sbt-bootstrap","fixed_in":["0.13.18-150200.4.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"xmvn-parent","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"maven","fixed_in":["3.9.4-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"maven-resolver","fixed_in":["1.9.15-150200.3.14.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"sbt","fixed_in":["0.13.18-150200.4.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"sbt-bootstrap","fixed_in":["0.13.18-150200.4.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xmvn","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xmvn-connector","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xmvn-mojo","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xmvn-parent","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xmvn-tools","fixed_in":["4.2.0-150200.3.14.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.scala-sbt:sbt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.4"},{"fixed":"1.9.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.scala-sbt:io_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.scala-sbt:io_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.scala-sbt:io_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.scala-sbt:sbt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.4"},{"fixed":"1.9.7"}]}],"versions":["0.99.2","0.99.4","1.0.0","1.0.0-M1","1.0.0-M2","1.0.0-M3","1.0.0-M4","1.0.0-M5","1.0.0-M6","1.0.0-RC1","1.0.0-RC2","1.0.0-RC3","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.0-M1","1.1.0-RC1","1.1.0-RC2","1.1.0-RC3","1.1.0-RC4","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.0-M1","1.2.0-RC1","1.2.0-RC2","1.2.0-RC3","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.3.0","1.3.0-M1","1.3.0-M2","1.3.0-M3","1.3.0-M4","1.3.0-M5","1.3.0-M5-94d5ec","1.3.0-RC1","1.3.0-RC2","1.3.0-RC3","1.3.0-RC4","1.3.0-RC5","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.0-M1","1.4.0-M2","1.4.0-RC1","1.4.0-RC2","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.0-M1","1.5.0-M2","1.5.0-RC1","1.5.0-RC2","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.6.0","1.6.0-M1","1.6.0-RC1","1.6.0-RC2","1.6.1","1.6.2","1.7.0","1.7.0-M1","1.7.0-M2","1.7.0-M2-6810fix","1.7.0-M3","1.7.0-RC1","1.7.0-RC2","1.7.1","1.7.2","1.7.3","1.8.0","1.8.0-RC1","1.8.1","1.8.2","1.8.3","1.9.0","1.9.0-M1","1.9.0-RC1","1.9.0-RC2","1.9.0-RC3","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6"]},{"source":"osv","ecosystem":"Maven","package":"org.scala-sbt:io_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.7"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.1.10","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.0-M1","1.2.0-M2","1.2.1","1.2.2","1.3.0","1.3.0-M1","1.3.0-M10","1.3.0-M11","1.3.0-M12","1.3.0-M13","1.3.0-M14","1.3.0-M15","1.3.0-M16","1.3.0-M17","1.3.0-M18","1.3.0-M2","1.3.0-M3","1.3.0-M4","1.3.0-M5","1.3.0-M6","1.3.0-M7","1.3.0-M8","1.3.0-M9","1.3.1","1.3.2","1.3.3","1.3.4","1.4.0","1.4.0-M1","1.4.0-M2","1.4.0-M3","1.4.0-M4","1.4.0-M5","1.4.0-M6","1.4.0-M7","1.4.0-M8","1.5.0","1.5.0-M1","1.5.1","1.6.0","1.6.0-M1","1.6.0-M2","1.7.0","1.8.0","1.8.1","1.9.0","1.9.0-M1","1.9.0-RC3","1.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.scala-sbt:io_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.7"}]}],"versions":["1.3.0","1.3.0-M11","1.3.0-M12","1.3.0-M13","1.3.0-M14","1.3.0-M15","1.3.0-M16","1.3.0-M17","1.3.0-M18","1.3.1","1.3.2","1.3.3","1.3.4","1.4.0","1.4.0-M1","1.4.0-M2","1.4.0-M3","1.4.0-M4","1.4.0-M5","1.4.0-M6","1.4.0-M7","1.4.0-M8","1.5.0","1.5.0-M1","1.5.1","1.6.0","1.6.0-M1","1.6.0-M2","1.7.0","1.8.0","1.8.1","1.9.0","1.9.0-M1","1.9.0-RC3","1.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.scala-sbt:io_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.7"}]}],"versions":["1.6.0","1.6.0-M2","1.7.0","1.8.0","1.8.1","1.9.0","1.9.0-M1","1.9.0-RC3","1.9.1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"sbt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-6.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"sbt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"sbt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"sbt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"sbt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"sbt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.18-150200.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"sbt-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.18-150200.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"sbt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.18-150200.4.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"sbt-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.18-150200.4.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xmvn-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-150200.3.14.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"sbt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.18-150200.4.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"sbt-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.18-150200.4.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xmvn-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-150200.3.14.1"}]}]}],"products":[{"vendor":"sbt","product":"sbt"},{"vendor":"scala-sbt","product":"io"},{"vendor":"scala-sbt","product":"sbt"}],"references":[{"url":"https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/sbt/io/issues/358","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","report","web"]},{"url":"https://github.com/sbt/io/pull/360","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46122","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h9mw-grgx-2fhf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46122.json","tags":["advisory"]},{"url":"https://github.com/sbt/sbt","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2422","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234527-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1162112","tags":["report"]},{"url":"https://bugzilla.suse.com/1216529","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46122","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-46122","title":"Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt","description":"sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.","status":"published","published":"2023-10-23T15:51:02.875Z","modified":"2024-09-17T13:45:20.258Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-2746","description":"sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.","status":"published","published":"2023-10-23T15:51:02Z","modified":"2024-09-17T13:45:20Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-03T00:28:22.305755Z"}],"ghsa":[{"id":"GHSA-h9mw-grgx-2fhf","title":"sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)","description":"### Impact\n\nGiven specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. The follow is an example of a malicious entry:\n\n```\n+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\nThis would have a potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks - https://github.com/search?q=IO.unzip+language%3AScala\u0026type=code\u0026l=Scala\u0026p=1\n\n### Patches\n\nThe problem has been patched in https://github.com/sbt/io/pull/360\nsbt 1.9.7 is available with the fix.\n\n### Workarounds\nA workaround might be use some other library to unzip.\n\n### References\n\n- https://github.com/snyk/zip-slip-vulnerability\n- https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680\n- https://github.com/sbt/io/issues/358","status":"published","published":"2023-10-24T01:51:04Z","modified":"2023-11-10T05:04:10Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:19.438667Z"}],"nvd":[{"id":"CVE-2023-46122","description":"sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.","status":"published","published":"2023-10-23T16:15:09.383Z","modified":"2026-06-17T06:30:11.763Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:39.058878Z"}],"osv":[{"id":"CVE-2023-46122","title":"Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt","description":"sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.","status":"published","published":"2023-10-23T15:51:02.875Z","modified":"2026-10-28T02:30:33.15954584Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"GHSA-h9mw-grgx-2fhf","title":"sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)","description":"### Impact\n\nGiven specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. The follow is an example of a malicious entry:\n\n```\n+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\nThis would have a potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks - https://github.com/search?q=IO.unzip+language%3AScala\u0026type=code\u0026l=Scala\u0026p=1\n\n### Patches\n\nThe problem has been patched in https://github.com/sbt/io/pull/360\nsbt 1.9.7 is available with the fix.\n\n### Workarounds\nA workaround might be use some other library to unzip.\n\n### References\n\n- https://github.com/snyk/zip-slip-vulnerability\n- https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680\n- https://github.com/sbt/io/issues/358","status":"published","published":"2023-10-24T01:51:04Z","modified":"2024-02-16T08:15:38.939403Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"OESA-2024-2422","title":"sbt security update","description":"sbt is the simple build tool for Scala and Java projects.\r\n\r\nSecurity Fix(es):\r\n\r\nsbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt\u0026apos;s main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.(CVE-2023-46122)","status":"published","published":"2024-11-15T11:07:53Z","modified":"2026-08-18T01:18:39.276291816Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"SUSE-SU-2023:4527-1","title":"Security update for maven, maven-resolver, sbt, xmvn","description":"This update for maven, maven-resolver, sbt, xmvn fixes the following issues:\n\n- CVE-2023-46122: Fixed an arbitrary file write when extracting a\n  crafted zip file with sbt (bsc#1216529).\n- Upgraded maven to version 3.9.4\n- Upgraded maven-resolver to version 1.9.15.\n","status":"published","published":"2023-11-22T13:39:05Z","modified":"2026-02-04T02:56:46.168942Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}