CVE-2022-2712

Name	CVE-2022-2712
Description	In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glassfish (PTS)	jessie	1:2.1.1-b31g+dfsg1-2	vulnerable
	stretch	1:2.1.1-b31g+dfsg1-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glassfish	source	stretch	(not affected)
glassfish	source	(unstable)	(unfixed)

[stretch] - glassfish <not-affected> (The vulnerable code was introduced later)
[jessie] - glassfish <postponed> (Minor issue)