CVE-2018-1002207
Arbitrary File Write via Archive Extraction in mholt/archiver
Résumé
Arbitrary File Write via Archive Extraction in mholt/archiver
Description d'origine
La description telle que publiée par la source (souvent en anglais).
mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Go
github.com/mholt/archiver
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}]
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web snyk.io
- web snyk.io