Security readout for executives and security teams
Plain-English summary
CVE-2022-1271 lets an attacker cause GNU gzip's zgrep utility to write attacker-controlled content to an attacker-selected file when zgrep processes a crafted filename. This matters most on systems that process untrusted files automatically, especially with elevated privileges.
Executive priority
Treat as high priority for Linux-heavy environments and file-processing workloads. Patch through normal emergency or accelerated maintenance, starting with internet-facing ingestion systems and privileged automation.
Technical view
The flaw is an arbitrary file write caused by insufficient validation of multiline filenames containing embedded content and target paths. Sources identify GNU gzip zgrep and xz-utils related grep wrappers, with gzip fixed in version 1.12. The CVSS v3.1 score is 8.8 high, mapped to CWE-179.
Likely exposure
Linux and Unix environments with vulnerable gzip or xz-utils packages are most exposed when zgrep or related grep wrappers process attacker-controlled filenames, archives, logs, uploads, or shared-directory content.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. Exploitation requires zgrep or a related wrapper to process an attacker-chosen crafted filename; automated processing increases business risk.
Researcher notes
Evidence is strong for the vulnerability class and gzip 1.12 fix. The bundle also includes xzgrep patch and commit references. It does not provide active exploitation evidence, complete vulnerable version ranges, or a full affected product matrix.
Mitigation direction
- Upgrade gzip to version 1.12 or vendor-fixed packages.
- Apply vendor updates for affected xz-utils packages where applicable.
- Prioritize servers processing untrusted uploads, logs, archives, or shared directories.
- Avoid privileged automated zgrep/xzgrep processing of untrusted filenames until patched.
- Track distro and vendor advisories for complete affected version guidance.
Validation and detection
- Inventory installed gzip and xz-utils versions across hosts and images.
- Confirm whether vendor package status marks CVE-2022-1271 fixed.
- Identify jobs, scripts, or services invoking zgrep or xzgrep on untrusted paths.
- Review file integrity alerts around directories writable by privileged automation.
- Include containers, build images, appliances, and NAS platforms in checks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-179: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-1271 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.redhat.com/show_bug.cgi?id=2073310CVE reference · x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2022/04/07/8CVE reference · x_refsource_MISC
- https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.htmlCVE reference · x_refsource_MISC
- https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patchCVE reference · x_refsource_MISC
- https://git.tukaani.org/?p=xz.git%3Ba=commit%3Bh=69d1b3fc29677af8ade8dc15dba83f0589cb63d6CVE reference · x_refsource_MISC
- https://security-tracker.debian.org/tracker/CVE-2022-1271CVE reference · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2022-1271CVE reference · x_refsource_MISC
- GLSA-202209-01CVE reference · vendor-advisory, x_refsource_GENTOO
- https://security.netapp.com/advisory/ntap-20220930-0006/CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Behavior Order: Early Validation
Incorrect Behavior Order: Early Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.