{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"Medium"
		},
		"category":"csaf_security_advisory",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"apache-commons-io security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for apache-commons-io is now available for openEuler-20.03-LTS-SP1.",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"Apache commons IO library is used for developing IO functionality. It contains a collecton of utilities with utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Security Fix(es): In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like //../foo , or .. foo , the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus limited path traversal), if the calling code would use the result to construct a path value.(CVE-2021-29425)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for apache-commons-io is now available for openEuler-20.03-LTS-SP1. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"Medium",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"apache-commons-io",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2021-1182",
				"category":"self",
				"url":"https://openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1182"
			},
			{
				"summary":"CVE-2021-29425",
				"category":"self",
				"url":"https://openeuler.org/en/security/cve/detail?cveId=CVE-2021-29425&packageName=apache-commons-io"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29425"
			},
			{
				"summary":"openEuler-SA-2021-1182 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2021/csaf-openeuler-sa-2021-1182.json"
			}
		],
		"title":"An update for apache-commons-io is now available for openEuler-20.03-LTS-SP1",
		"tracking":{
			"initial_release_date":"2025-06-11T10:25:58+08:00",
			"revision_history":[
				{
					"date":"2025-06-11T10:25:58+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				}
			],
			"generator":{
				"date":"2025-06-11T10:25:58+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2025-06-11T10:25:58+08:00",
			"id":"openEuler-SA-2021-1182",
			"version":"1.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"openEuler-20.03-LTS-SP1",
									"name":"openEuler-20.03-LTS-SP1"
								},
								"name":"openEuler-20.03-LTS-SP1",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"apache-commons-io-2.6-7.oe1.src.rpm",
									"name":"apache-commons-io-2.6-7.oe1.src.rpm"
								},
								"name":"apache-commons-io-2.6-7.oe1.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"apache-commons-io-2.6-7.oe1.noarch.rpm",
									"name":"apache-commons-io-2.6-7.oe1.noarch.rpm"
								},
								"name":"apache-commons-io-2.6-7.oe1.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"apache-commons-io-help-2.6-7.oe1.noarch.rpm",
									"name":"apache-commons-io-help-2.6-7.oe1.noarch.rpm"
								},
								"name":"apache-commons-io-help-2.6-7.oe1.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"apache-commons-io-2.6-7.oe1.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:apache-commons-io-2.6-7.oe1.src",
					"name":"apache-commons-io-2.6-7.oe1.src as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"apache-commons-io-2.6-7.oe1.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:apache-commons-io-2.6-7.oe1.noarch",
					"name":"apache-commons-io-2.6-7.oe1.noarch as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"apache-commons-io-help-2.6-7.oe1.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:apache-commons-io-help-2.6-7.oe1.noarch",
					"name":"apache-commons-io-help-2.6-7.oe1.noarch as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2021-29425",
			"notes":[
				{
					"text":"In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like //../foo , or .. foo , the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus limited path traversal), if the calling code would use the result to construct a path value.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-20.03-LTS-SP1:apache-commons-io-2.6-7.oe1.src",
					"openEuler-20.03-LTS-SP1:apache-commons-io-2.6-7.oe1.noarch",
					"openEuler-20.03-LTS-SP1:apache-commons-io-help-2.6-7.oe1.noarch"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-20.03-LTS-SP1:apache-commons-io-2.6-7.oe1.src",
						"openEuler-20.03-LTS-SP1:apache-commons-io-2.6-7.oe1.noarch",
						"openEuler-20.03-LTS-SP1:apache-commons-io-help-2.6-7.oe1.noarch"
					],
					"details":"apache-commons-io security update",
					"category":"vendor_fix",
					"url":"https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2021-1182"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.3,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-20.03-LTS-SP1:apache-commons-io-2.6-7.oe1.src",
						"openEuler-20.03-LTS-SP1:apache-commons-io-2.6-7.oe1.noarch",
						"openEuler-20.03-LTS-SP1:apache-commons-io-help-2.6-7.oe1.noarch"
					]
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2021-29425"
		}
	]
}