CVE-2018-1002207
Arbitrary File Write via Archive Extraction in mholt/archiver
概要
Arbitrary File Write via Archive Extraction in mholt/archiver
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Go
github.com/mholt/archiver
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}]
参照URL
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web snyk.io
- web snyk.io