# CVE-2022-37866: apache-ivy: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-37866: 	When Apa...

CVE-2022-37866 is fixed in 2 products on 1 platform, first by ALAS2023-2023-174, released April 27, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-37866
- Priority: High
- CVSS: n/a (important)
- EPSS: 0.0191
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 27, 2023

## Description

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-37866: 	When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing ".." sequences and a "normal" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.  CVE-2022-37865: 	A flaw was found in Apache Ivy. With Apache Ivy 2.4.0, an optional packaging attribute was introduced that allows artifacts to be unpacked on the fly if pack200 or zip packaging was used. This issue could allow a malicious user to have unwanted access. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | apache-ivy amzn 2023 | 2.5.1-1.amzn2023.0.1 | [ALAS2023-2023-174](https://patchblox.com/security/data/fix/linux/alas2023-2023-174.md) | Apr 27, 2023 |
| Linux | apache-ivy-javadoc amzn 2023 | 2.5.1-1.amzn2023.0.1 | [ALAS2023-2023-174](https://patchblox.com/security/data/fix/linux/alas2023-2023-174.md) | Apr 27, 2023 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.