CVE catalog

CVE-2022-1664

dpkg: CVE-2022-1664

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
3.24% · Oct 25, 2026

Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandpkgsid1.23.11fixed
Debiandpkgforky1.23.11fixed
Debiandpkgtrixie1.22.22fixed
Debiandpkgbookworm1.21.23fixed
Ubuntudpkgpro1.18.2ubuntu5vulnerable
Ubuntudpkgpro1.18.3ubuntu1vulnerable
Ubuntudpkgpro1.18.4ubuntu1vulnerable
Ubuntudpkgpro1.18.4ubuntu1.1vulnerable
Ubuntudpkgpro1.18.4ubuntu1.2vulnerable
Ubuntudpkgpro1.18.4ubuntu1.3vulnerable
Ubuntudpkgpro1.18.4ubuntu1.4vulnerable
Ubuntudpkgpro1.18.4ubuntu1.5vulnerable
Ubuntudpkgpro1.18.4ubuntu1.6vulnerable
Ubuntudpkgpro1.18.4ubuntu1.7vulnerable
Ubuntudpkgpro1.18.4ubuntu1.7+esm1fixed
Ubuntudpkg18.041.18.24ubuntu1vulnerable
Ubuntudpkg18.041.19.0.4ubuntu1vulnerable
Ubuntudpkg18.041.19.0.5ubuntu1vulnerable
Ubuntudpkg18.041.19.0.5ubuntu2vulnerable
Ubuntudpkg18.041.19.0.5ubuntu2.1vulnerable
Ubuntudpkg18.041.19.0.5ubuntu2.2vulnerable
Ubuntudpkg18.041.19.0.5ubuntu2.3vulnerable
Ubuntudpkg18.041.19.0.5ubuntu2.4fixed
Ubuntudpkg20.041.19.7ubuntu2vulnerable
Ubuntudpkg20.041.19.7ubuntu3vulnerable
Ubuntudpkg20.041.19.7ubuntu3.2fixed
Ubuntudpkg22.041.20.9ubuntu2vulnerable
Ubuntudpkg22.041.20.9ubuntu3vulnerable
Ubuntudpkg22.041.21.1ubuntu1vulnerable
Ubuntudpkg22.041.21.1ubuntu2vulnerable
Ubuntudpkg22.041.21.1ubuntu2.1fixed
Ubuntudpkgpro1.18.2ubuntu5vulnerable
Ubuntudpkgpro1.18.3ubuntu1vulnerable
Ubuntudpkgpro1.18.4ubuntu1vulnerable
Ubuntudpkgpro1.18.4ubuntu1.1vulnerable
Ubuntudpkgpro1.18.4ubuntu1.2vulnerable
Ubuntudpkgpro1.18.4ubuntu1.3vulnerable
Ubuntudpkgpro1.18.4ubuntu1.4vulnerable
Ubuntudpkgpro1.18.4ubuntu1.5vulnerable
Ubuntudpkgpro1.18.4ubuntu1.6vulnerable
Ubuntudpkgpro1.18.4ubuntu1.7vulnerable
Ubuntudpkgpro1.18.4ubuntu1.7+esm1fixed
Ubuntudpkg18.041.18.24ubuntu1vulnerable
Ubuntudpkg18.041.19.0.4ubuntu1vulnerable
Ubuntudpkg18.041.19.0.5ubuntu1vulnerable
Ubuntudpkg18.041.19.0.5ubuntu2vulnerable
Ubuntudpkg18.041.19.0.5ubuntu2.1vulnerable
Ubuntudpkg18.041.19.0.5ubuntu2.2vulnerable
Ubuntudpkg18.041.19.0.5ubuntu2.3vulnerable
Ubuntudpkg18.041.19.0.5ubuntu2.4fixed
Ubuntudpkg20.041.19.7ubuntu2vulnerable
Ubuntudpkg20.041.19.7ubuntu3vulnerable
Ubuntudpkg20.041.19.7ubuntu3.2fixed
Ubuntudpkg22.041.20.9ubuntu2vulnerable
Ubuntudpkg22.041.20.9ubuntu3vulnerable
Ubuntudpkg22.041.21.1ubuntu1vulnerable
Ubuntudpkg22.041.21.1ubuntu2vulnerable
Ubuntudpkg22.041.21.1ubuntu2.1fixed
Suseupdate-alternativeslinux enterprise server 12 sp51.18.4-16.3.5fixed
Suseupdate-alternativeslinux enterprise server for sap applications 12 sp51.18.4-16.3.5fixed
Suseupdate-alternativeslinux enterprise micro 5.31.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise module for basesystem 15 sp31.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise module for basesystem 15 sp41.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise module for development tools 15 sp31.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise module for development tools 15 sp41.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise high performance computing 15-espos1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise high performance computing 15-espos1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise high performance computing 15-ltss1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise high performance computing 15-ltss1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise high performance computing 15 sp1-espos1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise high performance computing 15 sp1-espos1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise high performance computing 15 sp1-ltss1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise high performance computing 15 sp1-ltss1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise high performance computing 15 sp2-espos1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise high performance computing 15 sp2-espos1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise high performance computing 15 sp2-ltss1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise high performance computing 15 sp2-ltss1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise server 15-ltss1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise server 15-ltss1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise server 15 sp1-bcl1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise server 15 sp1-bcl1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise server 15 sp1-ltss1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise server 15 sp1-ltss1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise server 15 sp2-bcl1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise server 15 sp2-bcl1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise server 15 sp2-ltss1.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise server 15 sp2-ltss1.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise server for sap applications 151.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise server for sap applications 151.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise server for sap applications 15 sp11.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise server for sap applications 15 sp11.19.0.4-150000.4.4.1fixed
Susedpkglinux enterprise server for sap applications 15 sp21.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise server for sap applications 15 sp21.19.0.4-150000.4.4.1fixed
Susedpkgmanager proxy 4.11.19.0.4-150000.4.4.1fixed
Suseupdate-alternativesmanager proxy 4.11.19.0.4-150000.4.4.1fixed
Susedpkgmanager retail branch server 4.11.19.0.4-150000.4.4.1fixed
Suseupdate-alternativesmanager retail branch server 4.11.19.0.4-150000.4.4.1fixed
Susedpkgmanager server 4.11.19.0.4-150000.4.4.1fixed
Suseupdate-alternativesmanager server 4.11.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise micro 5.11.19.0.4-150000.4.4.1fixed
Suseupdate-alternativeslinux enterprise micro 5.21.19.0.4-150000.4.4.1fixed
Susedpkgenterprise storage 61.19.0.4-150000.4.4.1fixed
Suseupdate-alternativesenterprise storage 61.19.0.4-150000.4.4.1fixed
Susedpkgenterprise storage 71.19.0.4-150000.4.4.1fixed
Suseupdate-alternativesenterprise storage 71.19.0.4-150000.4.4.1fixed
Opensuseupdate-alternativesleap micro 5.21.19.0.4-150000.4.4.1fixed
Opensuseupdate-alternativesleap micro 5.31.19.0.4-150000.4.4.1fixed
Opensusedpkgleap 15.31.19.0.4-150000.4.4.1fixed
Opensuseupdate-alternativesleap 15.31.19.0.4-150000.4.4.1fixed
Opensusedpkgleap 15.41.19.0.4-150000.4.4.1fixed
Opensuseupdate-alternativesleap 15.41.19.0.4-150000.4.4.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandpkgsourcesid1.21.8not yet assignedNot reportedNot reported
Debiandpkgsourceforky1.21.8not yet assignedNot reportedNot reported
Debiandpkgsourcetrixie1.21.8not yet assignedNot reportedNot reported
Debiandpkgsourcebookworm1.21.8not yet assignedNot reportedNot reported
Ubuntudpkgdebpro1.18.4ubuntu1.7+esm1Not reportedUSN-5446-2Not reported
Ubuntudpkgdeb18.041.19.0.5ubuntu2.4Not reportedUSN-5446-1Not reported
Ubuntudpkgdeb20.041.19.7ubuntu3.2Not reportedUSN-5446-1Not reported
Ubuntudpkgdeb22.041.21.1ubuntu2.1Not reportedUSN-5446-1Not reported
Ubuntudpkgdebpro1.18.4ubuntu1.7+esm1Not reportedUBUNTU-CVE-2022-1664Not reported
Ubuntudpkgdeb18.041.19.0.5ubuntu2.4Not reportedUBUNTU-CVE-2022-1664Not reported
Ubuntudpkgdeb20.041.19.7ubuntu3.2Not reportedUBUNTU-CVE-2022-1664Not reported
Ubuntudpkgdeb22.041.21.1ubuntu2.1Not reportedUBUNTU-CVE-2022-1664Not reported
Suseupdate-alternativesrpmlinux enterprise server 12 sp51.18.4-16.3.5Not reportedSUSE-SU-2022:2689-1Not reported
Suseupdate-alternativesrpmlinux enterprise server for sap applications 12 sp51.18.4-16.3.5Not reportedSUSE-SU-2022:2689-1Not reported
Suseupdate-alternativesrpmlinux enterprise micro 5.31.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise module for basesystem 15 sp31.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise module for basesystem 15 sp41.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise module for development tools 15 sp31.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise module for development tools 15 sp41.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise high performance computing 15-espos1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise high performance computing 15-espos1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise high performance computing 15-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise high performance computing 15-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise high performance computing 15 sp1-espos1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise high performance computing 15 sp1-espos1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise high performance computing 15 sp1-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise high performance computing 15 sp1-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise high performance computing 15 sp2-espos1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise high performance computing 15 sp2-espos1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise high performance computing 15 sp2-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise high performance computing 15 sp2-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise server 15-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise server 15-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise server 15 sp1-bcl1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise server 15 sp1-bcl1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise server 15 sp1-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise server 15 sp1-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise server 15 sp2-bcl1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise server 15 sp2-bcl1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise server 15 sp2-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise server 15 sp2-ltss1.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise server for sap applications 151.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise server for sap applications 151.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise server for sap applications 15 sp11.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise server for sap applications 15 sp11.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmlinux enterprise server for sap applications 15 sp21.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise server for sap applications 15 sp21.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmmanager proxy 4.11.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmmanager proxy 4.11.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmmanager retail branch server 4.11.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmmanager retail branch server 4.11.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmmanager server 4.11.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmmanager server 4.11.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise micro 5.11.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmlinux enterprise micro 5.21.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmenterprise storage 61.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmenterprise storage 61.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Susedpkgrpmenterprise storage 71.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Suseupdate-alternativesrpmenterprise storage 71.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Opensuseupdate-alternativesrpmleap micro 5.21.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Opensuseupdate-alternativesrpmleap micro 5.31.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Opensusedpkgrpmleap 15.31.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Opensuseupdate-alternativesrpmleap 15.31.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Opensusedpkgrpmleap 15.41.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported
Opensuseupdate-alternativesrpmleap 15.41.19.0.4-150000.4.4.1Not reportedSUSE-SU-2022:4081-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [dpkg]Fixed
    Details (2)
    • 1.21.23 · amd64 · bookworm

      Fixed · Fixed: 1.21.8

      dsa · dpkg · debian · bookworm

    • 1.21.23 · arm64 · bookworm

      Fixed · Fixed: 1.21.8

      dsa · dpkg · debian · bookworm

  • [dpkg-dev]Fixed

    Source package: [dpkg]

    Details (2)
    • 1.21.23 · all · bookworm

      Fixed · Fixed: 1.21.8

      dsa · dpkg · debian · bookworm

    • 1.21.23 · all · bookworm

      Fixed · Fixed: 1.21.8

      dsa · dpkg · debian · bookworm

  • [dselect]Fixed

    Source package: [dpkg]

    Details (2)
    • 1.21.23 · amd64 · bookworm

      Fixed · Fixed: 1.21.8

      dsa · dpkg · debian · bookworm

    • 1.21.23 · arm64 · bookworm

      Fixed · Fixed: 1.21.8

      dsa · dpkg · debian · bookworm

  • Source package: [dpkg]

    Details (2)
    • 1.21.23 · amd64 · bookworm

      Fixed · Fixed: 1.21.8

      dsa · dpkg · debian · bookworm

    • 1.21.23 · arm64 · bookworm

      Fixed · Fixed: 1.21.8

      dsa · dpkg · debian · bookworm

  • Source package: [dpkg]

    Details (2)
    • 1.21.23 · all · bookworm

      Fixed · Fixed: 1.21.8

      dsa · dpkg · debian · bookworm

    • 1.21.23 · all · bookworm

      Fixed · Fixed: 1.21.8

      dsa · dpkg · debian · bookworm

Observed:

References