Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yZzVqLTV4OTUtcjZocs4AAxdO

Unsafe tar unpacking in HashiCorp go-slug

HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks.

Permalink: https://github.com/advisories/GHSA-2g5j-5x95-r6hr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yZzVqLTV4OTUtcjZocs4AAxdO
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-2g5j-5x95-r6hr, CVE-2020-29529
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-29529
• https://github.com/hashicorp/go-slug/pull/12
• https://github.com/hashicorp/go-slug/commit/28cafc59c8da6126a3ae94dfa84181df4073454f
• https://github.com/hashicorp/go-slug/commit/764785bc4cbb9e600ad1cf1a6bd21b535c182983
• https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0
• https://github.com/hashicorp/go-slug/releases/tag/v0.5.0
• https://pkg.go.dev/vuln/GO-2021-0094
• https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug
• https://github.com/advisories/GHSA-2g5j-5x95-r6hr

Repository: https://github.com/hashicorp/go-slug
Blast Radius: 24.0

Affected Packages