CVE-2025-0851
Critical · 9.8CVSS
9.8
EPSS
23.3%
Published
Jan 29, 2025
CISA due date
—
The record
A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | ai.djl:api | 0 | 0.31.1 |
| Chainguard | opensearch-2 | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2 | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-alerting | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-alerting | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-analysis-icu | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-analysis-icu | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-analysis-kuromoji | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-analysis-kuromoji | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-analysis-nori | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-analysis-nori | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-analysis-phonetic | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-analysis-phonetic | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-analysis-smartcn | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-analysis-smartcn | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-analysis-stempel | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-analysis-stempel | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-analysis-ukrainian | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-analysis-ukrainian | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-anomaly-detection | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-anomaly-detection | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-asynchronous-search | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-asynchronous-search | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-cross-cluster-replication | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-cross-cluster-replication | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-crypto-kms | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-crypto-kms | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-custom-codecs | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-custom-codecs | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-discovery-azure-classic | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-discovery-azure-classic | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-discovery-ec2 | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-discovery-ec2 | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-discovery-gce | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-discovery-gce | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-entrypoint-compat | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-geospatial | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-geospatial | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-identity-shiro | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-identity-shiro | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-index-management | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-index-management | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-ingest-attachment | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-ingest-attachment | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-job-scheduler | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-job-scheduler | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-jre-bcfips | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-alerting | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-alerting | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-analysis-icu | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-analysis-icu | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-analysis-kuromoji | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-analysis-kuromoji | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-analysis-nori | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-analysis-nori | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-analysis-phonetic | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-analysis-phonetic | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-analysis-smartcn | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-analysis-smartcn | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-analysis-stempel | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-analysis-stempel | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-analysis-ukrainian | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-analysis-ukrainian | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-anomaly-detection | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-anomaly-detection | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-asynchronous-search | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-asynchronous-search | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-cross-cluster-replication | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-cross-cluster-replication | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-crypto-kms | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-crypto-kms | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-custom-codecs | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-custom-codecs | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-discovery-azure-classic | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-discovery-azure-classic | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-discovery-ec2 | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-discovery-ec2 | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-discovery-gce | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-discovery-gce | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-geospatial | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-geospatial | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-identity-shiro | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-identity-shiro | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-index-management | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-index-management | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-ingest-attachment | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-ingest-attachment | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-job-scheduler | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-job-scheduler | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-k-nn | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-k-nn | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-mapper-annotated-text | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-mapper-annotated-text | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-mapper-murmur3 | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-mapper-murmur3 | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-mapper-size | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-mapper-size | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-ml-commons | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-ml-commons | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-neural-search | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-neural-search | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-notifications | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-notifications | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-observability | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-observability | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-performance-analyzer | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-performance-analyzer | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-reporting | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-reporting | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-repository-azure | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-repository-azure | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-repository-gcs | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-repository-gcs | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-repository-s3 | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-repository-s3 | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-security | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-security | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-security-analytics | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-security-analytics | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-sql | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-sql | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-store-smb | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-store-smb | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-telemetry-otel | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-telemetry-otel | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-jre-bcfips-transport-nio | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-jre-bcfips-transport-nio | 0 | 2.18.0-r3 |
| Chainguard | opensearch-2-k-nn | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-k-nn | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-mapper-annotated-text | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-mapper-annotated-text | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-mapper-murmur3 | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-mapper-murmur3 | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-mapper-size | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-mapper-size | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-ml-commons | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-ml-commons | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-neural-search | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-neural-search | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-notifications | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-notifications | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-observability | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-observability | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-performance-analyzer | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-performance-analyzer | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-reporting | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-reporting | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-repository-azure | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-repository-azure | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-repository-gcs | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-repository-gcs | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-repository-s3 | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-repository-s3 | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-security | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-security | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-security-analytics | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-security-analytics | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-sql | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-sql | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-store-smb | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-store-smb | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-telemetry-otel | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-telemetry-otel | 0 | 2.18.0-r1 |
| Chainguard | opensearch-2-transport-nio | 0 | 2.19.1-r0 |
| Chainguard | opensearch-2-transport-nio | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2 | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2 | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-alerting | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-alerting | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-analysis-icu | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-analysis-icu | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-analysis-kuromoji | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-analysis-kuromoji | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-analysis-nori | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-analysis-nori | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-analysis-phonetic | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-analysis-phonetic | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-analysis-smartcn | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-analysis-smartcn | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-analysis-stempel | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-analysis-stempel | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-analysis-ukrainian | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-analysis-ukrainian | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-anomaly-detection | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-anomaly-detection | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-asynchronous-search | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-asynchronous-search | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-cross-cluster-replication | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-cross-cluster-replication | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-crypto-kms | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-crypto-kms | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-custom-codecs | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-custom-codecs | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-discovery-azure-classic | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-discovery-azure-classic | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-discovery-ec2 | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-discovery-ec2 | 0 | 2.18.0-r1 |
| Wolfi | opensearch-2-discovery-gce | 0 | 2.19.1-r0 |
| Wolfi | opensearch-2-discovery-gce | 0 | 2.18.0-r1 |
Related vulnerabilities
- CVE-2025-68161 Apache Log4j does not verify the TLS hostname in its Socket Appender Also affects opensearch-2
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects opensearch-2
- CVE-2025-9624 OpenSearch is vulnerable to DoS via complex query_string inputs Also affects opensearch-2
- CVE-2025-58056 Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions Also affects opensearch-2
- CVE-2025-54988 Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and… Also affects opensearch-2
- CVE-2025-8916 Allocation of Resources Without Limits or Throttling vulnerability in Legion of the… Also affects opensearch-2
- CVE-2025-55163 Netty affected by MadeYouReset HTTP/2 DDoS vulnerability Also affects opensearch-2
- CVE-2025-8885 Allocation of Resources Without Limits or Throttling vulnerability in Legion of the… Also affects opensearch-2