CVE-2021-29425

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

• apache commons io 2.2 • apache commons io 2.3 • apache commons io 2.4 • apache commons io 2.5 • apache commons io 2.6 • debian debian linux 9.0 • oracle access manager 11.1.2.3.0 • oracle access manager 12.2.1.3.0 • oracle access manager 12.2.1.4.0 • oracle agile engineering data management 6.2.1.0 • oracle agile product lifecycle management 9.3.6 • oracle application performance management 13.4.1.0 • oracle application performance management 13.5.1.0 • oracle application testing suite 13.3.0.1 • oracle banking apis 18.1 • oracle banking apis 18.2 • oracle banking apis 18.3 • oracle banking apis 19.1 • oracle banking apis 19.2 • oracle banking apis 20.1 • oracle banking apis 21.1 • oracle banking digital experience 17.2 • oracle banking digital experience 18.1 • oracle banking digital experience 18.3 • oracle banking digital experience 19.1 • oracle banking digital experience 19.2 • oracle banking digital experience 20.1 • oracle banking digital experience 21.1 • oracle banking enterprise default management 2.6.2 • oracle banking enterprise default management 2.7.0 • oracle banking enterprise default management 2.7.1 • oracle banking enterprise default management 2.10.0 • oracle banking enterprise default management 2.12.0 • oracle banking enterprise default managment (>= 2.3.0 <= 2.4.0) • oracle banking party management 2.7.0 • oracle banking platform (>= 2.3.0 <= 2.4.1) • oracle banking platform 2.6.2 • oracle banking platform 2.7.0 • oracle banking platform 2.7.1 • oracle blockchain platform (< 21.1.2) • oracle commerce guided search 11.3.2 • oracle communications application session controller 3.9.0 • oracle communications billing and revenue management elastic charging engine 11.3 • oracle communications billing and revenue management elastic charging engine 12.0 • oracle communications cloud native core network repository function 1.14.0 • oracle communications cloud native core policy 1.14.0 • oracle communications cloud native core unified data repository 1.4.0 • oracle communications contacts server 8.0.0.6.0 • oracle communications converged application server - service controller 6.2 • oracle communications convergence 3.0.2.2.0 • oracle communications design studio (>= 7.4.0 <= 7.4.2) • oracle communications design studio 7.3.5 • oracle communications diameter intelligence hub (>= 8.0.0 <= 8.1.0) • oracle communications diameter intelligence hub (>= 8.2.0 <= 8.2.3) • oracle communications interactive session recorder 6.3 • oracle communications interactive session recorder 6.4 • oracle communications offline mediation controller 12.0.0.3 • oracle communications order and service management 7.3 • oracle communications order and service management 7.4 • oracle communications policy management 12.5.0.0.0 … and 74 more