CVE-2022-1271 is a new vulnerability affecting gzip, a widely used open source component for archiving, compressing, and decompressing files.
CVE-2022-1271, also tracked in the Black Duck KnowledgeBase™ as BDSA-2022-0958, is a bug in gzip, a file format and software application used for archiving, compressing, and decompressing files. Although a vulnerability in gzip has the potential to be cataclysmic, this vulnerability is actually in zgrep, a command used for searching through a gzip archive for a string.
Using filenames with newline characters can confuse zgrep, which can enable an attacker to overwrite arbitrary files. When GNU sed is also installed, the attacker can gain the ability to perform code execution. Most applications won’t have gzip bundled in this way, but they might make a runtime call to a command line to invoke zgrep. In such a case, if the application uses unsanitized user input for the filename, the vulnerability could be exposed.
Container images used for cloud deployments will almost certainly have gzip. However, if you are not using the zgrep command, you won’t be affected by this vulnerability.
Software composition analysis (SCA) tools are designed for exactly this kind of situation. An SCA tool scans application source code and container images and compiles a catalog of the open source software components, known as a software Bill of Materials (SBOM). When new vulnerabilities are discovered, such as CVE-2022-1271, a good SCA tool will proactively notify you so you can address the issue right away.
If your application does use zgrep, and an attacker could supply filenames with newlines, you should upgrade gzip as soon as possible to the latest version, which is 1.12.
Check out our video on CVE-2022-1271, which includes a demonstration.
Jonathan Knudsen likes to break things. He has tested all kinds of software, from network infrastructure and medical devices to cryptocurrency nodes. Jonathan has worked as a developer, consultant, and author. He has published books about 2D graphics, cryptography, and Lego robots, and has written more than one hundred articles on a wide range of technical subjects.