USN-7030-1: py7zr vulnerability
24 September 2024
py7zr could be made to create arbitrary files when extracting the contents of a specially crafted 7z archive.
Releases
Packages
- py7zr - Pure Python 7-zip library
Details
It was discovered that py7zr was vulnerable to path traversal attacks.
If a user or automated system were tricked into extracting a specially
crafted 7z archive, an attacker could possibly use this issue to write
arbitrary files outside the target directory on the host.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04
In general, a standard system update will make all the necessary changes.