Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ocHhyLXc5dzctZzRnds4AA4-o

stereoscope vulnerable to tar path traversal when processing OCI tar archives

Impact

It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. Specifically, use of github.com/anchore/stereoscope/pkg/file.UntarToDirectory() function, the github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider struct, or the higher level github.com/anchore/stereoscope/pkg/image.Image.Read() function express this vulnerability.

Patches

Patched in v0.0.1

Workarounds

If you are using the OCI archive as input into stereoscope then you can switch to using an OCI layout by unarchiving the tar archive and provide the unarchived directory to stereoscope.

References

• Patch PR https://github.com/anchore/stereoscope/pull/214

Permalink: https://github.com/advisories/GHSA-hpxr-w9w7-g4gv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocHhyLXc5dzctZzRnds4AA4-o
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Identifiers: GHSA-hpxr-w9w7-g4gv, CVE-2024-24579
References:

• https://github.com/anchore/stereoscope/security/advisories/GHSA-hpxr-w9w7-g4gv
• https://nvd.nist.gov/vuln/detail/CVE-2024-24579
• https://github.com/anchore/stereoscope/commit/09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204
• https://github.com/advisories/GHSA-hpxr-w9w7-g4gv

Repository: https://github.com/anchore/stereoscope
Blast Radius: 12.2

Affected Packages