CVE-2022-30333
Fixed in a distro release ExploitedEPSS 99%CVSS 9.8
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
Products: rarlab unrar, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | rar | 2:6.20-0.1~deb10u1 |
| Debian 12 | rar | 2:6.20~b1-0.1 |
| Debian 12 | unrar-nonfree | 1:6.1.7-1 |
| Debian 13 | rar | 2:6.20~b1-0.1 |
| Debian 13 | unrar-nonfree | 1:6.1.7-1 |
| Debian 14 | rar | 2:6.20~b1-0.1 |
| Debian 14 | unrar-nonfree | 1:6.1.7-1 |
| SUSE Linux Enterprise Server 12 SP5 | unrar | 5.6.1-4.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | unrar | 5.6.1-4.8.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | unrar | 5.6.1-4.8.1 |
| Ubuntu 16.04 LTS | libclamunrar | no fix |
| Ubuntu 16.04 LTS | rar | no fix |
| Ubuntu 16.04 LTS | unrar-nonfree | no fix |
| Ubuntu 18.04 LTS | libclamunrar | no fix |
| Ubuntu 18.04 LTS | rar | no fix |
| Ubuntu 18.04 LTS | unrar-nonfree | no fix |
| Ubuntu 20.04 LTS | libclamunrar | 0.103.11-0ubuntu0.20.04.1 |
| Ubuntu 20.04 LTS | rar | 2:6.23-1~20.04.1 |
| Ubuntu 20.04 LTS | unrar-nonfree | 1:5.6.6-2ubuntu0.1 |
| Ubuntu 22.04 LTS | libclamunrar | 0.103.11-0ubuntu0.22.04.1 |
| Ubuntu 22.04 LTS | rar | 2:6.23-1~22.04.1 |
| Ubuntu 22.04 LTS | unrar-nonfree | 1:6.1.5-1ubuntu0.1 |
| Ubuntu 24.04 LTS | rar | 2:6.23-1 |