CVE-2022-1664 - CVE House
Back to Database
Status published Critical CVE-2022-1664

directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar

Vulnerability Description

Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-1664

Credits & Attribution

No credits recorded in the NVD database.

References

More from Debian

View All →
CVE-2025-8454
It was discovered that uscan, a tool to scan/watch upstream...
Unknown 0
CVE-2025-6297
dpkg-deb: Fix cleanup for control member with restricted directories
Unknown 0
CVE-2025-68462
Freedombox before 25.17.1 does not set proper permissions for the...
Low 3.2
CVE-2025-53391
The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package...
Critical 9.3
CVE-2025-47153
Certain build processes for libuv and Node.js for 32-bit systems,...
Medium 6.5

Affected Vendor

Affected Software

dpkg
Vulnerable Versions:
1.14.17

Timeline

Official Publish: May 26th, 2022
Last Modified: September 17th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.