Arch Linux 202204-7 High Advisory: Gzip Command Execution Threat

Arch Linux Security Advisory ASA-202204-7
========================================
Severity: High
Date    : 2022-04-07
CVE-ID  : CVE-2022-1271
Package : gzip
Type    : arbitrary command execution
Remote  : No
Link    : https://security.archlinux.org/AVG-2666

Summary
======
The package gzip before version 1.12-1 is vulnerable to arbitrary
command execution.

Resolution
=========
Upgrade to 1.12-1.

# pacman -Syu "gzip>=1.12-1"

The problem has been fixed upstream in version 1.12.

Workaround
=========
None.

Description
==========
Malicious filenames with two or more newlines can make zgrep and xzgrep
to write to arbitrary files or (with a GNU sed extension) lead to
arbitrary code execution. The issue with the old code is that with
multiple newlines, the N-command will read the second line of input,
then the s-commands will be skipped because it's not the end of  the
file yet, then a new sed cycle starts and the pattern space is printed
and emptied. So only the last line or two get escaped.

Impact
=====
An attacker is able to provide malicious filenames to write to
arbitrary files or execute arbitrary commands on the affected host.

References
=========

https://savannah.gnu.org/forum/forum.php?forum_id=10157

https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch
https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch.sig
https://security.archlinux.org/CVE-2022-1271