CVE-2022-1664: directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-26 · updated 2026-06-17
Weakness: CWE-22

Description

Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.

Affected products

Debian Linux: 9.0, 10.0, 11.0
Debian dpkg: from 1.14.17 before 1.18.26; from 1.19.0 before 1.19.8; from 1.20.0 before 1.20.10; from 1.21.0 before 1.21.8 — fixed in 1.18.26, 1.19.8, 1.20.10, 1.21.8
NetApp ONTAP Select Deploy administration utility: all versions

How to fix

Upgrade to a fixed version: Debian dpkg 1.18.26, 1.19.8, 1.20.10, 1.21.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-1664 or the next vulnerability affects your stack