Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02anJqLXZjNjUtYzk4M84AA-8j

unzip-stream allows Arbitrary File Write via artifact extraction

Impact

When using the Extract() method of unzip-stream, malicious zip files were able to write to paths they shouldn't be allowed to.

Patches

Fixed in 0.3.2

References

• https://snyk.io/research/zip-slip-vulnerability
• https://github.com/mhr3/unzip-stream/compare/v0.3.1...v0.3.2

Credits

Justin Taft from Google

Permalink: https://github.com/advisories/GHSA-6jrj-vc65-c983
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02anJqLXZjNjUtYzk4M84AA-8j
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-6jrj-vc65-c983
References:

• https://github.com/mhr3/unzip-stream/security/advisories/GHSA-6jrj-vc65-c983
• https://github.com/mhr3/unzip-stream/commit/ab67989719abb4dcc774d02de266151905b8d45a
• https://github.com/mhr3/unzip-stream/compare/v0.3.1...v0.3.2
• https://snyk.io/research/zip-slip-vulnerability
• https://github.com/advisories/GHSA-6jrj-vc65-c983

Repository: https://github.com/mhr3/unzip-stream
Blast Radius: 26.8

Affected Packages