rpms/plexus-utils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS git plexus-utils-3.3.0-11.el8.1

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-07-16 07:37:25 -04:00
parent 31ff2d8a77
commit eb61f7b748
2 changed files with 36 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
SOURCES/CVE-2025-67030.patch Normal file
View File

@ -0,0 +1,25 @@
--- a/src/main/java/org/codehaus/plexus/util/Expand.java 2026-05-20 09:19:51.014184013 +0000
+++ b/src/main/java/org/codehaus/plexus/util/Expand.java 2026-05-20 09:20:05.847146005 +0000
@@ -116,9 +116,20 @@
{
File f = FileUtils.resolveFile( dir, entryName );
- if ( !f.getAbsolutePath().startsWith( dir.getAbsolutePath() ) )
+ try
+ {
+ String canonicalDirPath = dir.getCanonicalPath();
+ String canonicalFilePath = f.getCanonicalPath();
+
+ if ( !canonicalFilePath.startsWith( canonicalDirPath + File.separator )
+ && !canonicalFilePath.equals( canonicalDirPath ) )
+ {
+ throw new IOException( "Entry '" + entryName + "' outside the target directory." );
+ }
+ }
+ catch ( IOException e )
{
- throw new IOException( "Entry '" + entryName + "' outside the target directory." );
+ throw new IOException( "Failed to verify entry path for '" + entryName + "'", e );
}
try

12
SPECS/plexus-utils.spec
View File

@ -2,7 +2,7 @@
Name: plexus-utils
Version: 3.3.0
Release: 10%{?dist}
Release: 11%{?dist}.1
Summary: Plexus Common Utilities
# ASL 1.1: several files in src/main/java/org/codehaus/plexus/util/
# xpp: src/main/java/org/codehaus/plexus/util/xml/pull directory
@ -20,6 +20,8 @@ ExclusiveArch: %{java_arches} noarch
Source0: https://github.com/codehaus-plexus/%{name}/archive/%{name}-%{version}.tar.gz
Source1: http://apache.org/licenses/LICENSE-2.0.txt
Patch0: CVE-2025-67030.patch
%if %{with bootstrap}
BuildRequires: javapackages-bootstrap-openjdk8
%else
@ -41,6 +43,7 @@ is like a J2EE application server, without all the baggage.
%prep
%setup -q -n %{name}-%{name}-%{version}
%patch -P0 -p1
cp %{SOURCE1} .
@ -72,6 +75,13 @@ cp %{SOURCE1} .
%license NOTICE.txt LICENSE-2.0.txt
%changelog
* Tue May 20 2025 Jacek Migacz <jmigacz@redhat.com> - 3.3.0-11.el8_10.1
- Fix CVE-2025-67030: Directory Traversal in Expand.extractFile
Resolves: RHEL-165339
* Mon Feb 05 2024 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.3.0-11
- Rebuild to regenerate auto-requires
* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.0-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild