CVE-2023-31131CWE-22

Arbitrary File Write when Extracting Tarballs in greenplum-db

High · published May 15, 2023

CVSS v3.1
7.4
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file writes. An attacker can use this vulnerability to overwrite data or system files potentially leading to crash or malfunction of the system. Any files which are accessible to the running process are at risk. All users are requested to upgrade to Greenplum Database version 6.23.2 or higher. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00746 · 54.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-05-15T21:05Z
EPSS history
Timeline
  • 15 MAY 21:05Z
    Arbitrary File Write when Extracting Tarballs in greenplum-db
    cvelistv5