CVE-2022-1664

Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.

• CWE-22

• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495Mailing List, Patch, Vendor Advisory
• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5Mailing List, Patch, Vendor Advisory
• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200bMailing List, Patch, Vendor Advisory
• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24beMailing List, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/05/msg00033.htmlMailing List, Vendor Advisory
• https://lists.debian.org/debian-security-announce/2022/msg00115.htmlMailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20221007-0002/Third Party Advisory
• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495Mailing List, Patch, Vendor Advisory
• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5Mailing List, Patch, Vendor Advisory
• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200bMailing List, Patch, Vendor Advisory
• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24beMailing List, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/05/msg00033.htmlMailing List, Vendor Advisory
• https://lists.debian.org/debian-security-announce/2022/msg00115.htmlMailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20221007-0002/Third Party Advisory

Published

May 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1658Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow a…5.4
• CVE-2022-1659Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin r…7.3
• CVE-2022-1660The affected products are vulnerable of untrusted data due t…9.8
• CVE-2022-1661The affected products are vulnerable to directory traversal,…7.5
• CVE-2022-1662In convert2rhel, there's an ansible playbook named ansible/r…5.5
• CVE-2022-1663The Stop Spam Comments WordPress plugin through 0.2.1.2 does…6.5
• CVE-2022-1665A set of pre-production kernel packages of Red Hat Enterpris…8.2
• CVE-2022-1666The default password for the web application’s root user (th…6.5
• CVE-2022-1667Client-side JavaScript controls may be bypassed by directly …7.5
• CVE-2022-1668Weak default root user credentials allow remote attackers to…9.8
• CVE-2022-1669A buffer overflow vulnerability has been detected in the fir…8.1
• CVE-2022-1670When generating a user invitation code in Octopus Server, th…7.5