Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXY5ajQtY3A2My1xdjYy

Tarslip in go-unarr

unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.

Permalink: https://github.com/advisories/GHSA-v9j4-cp63-qv62
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXY5ajQtY3A2My1xdjYy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: 11 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-v9j4-cp63-qv62, CVE-2021-38197
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-38197
• https://github.com/gen2brain/go-unarr/issues/21
• https://github.com/gen2brain/go-unarr/commit/239ec404d348280b50bbf671327709e8857fc5f4
• https://github.com/gen2brain/go-unarr/releases/tag/v0.1.4
• https://github.com/advisories/GHSA-v9j4-cp63-qv62

Repository: https://github.com/gen2brain/go-unarr
Blast Radius: 15.8

Affected Packages