Path traversal on Windows in path/filepath (CVE-2022-41722)

Summary

Path traversal on Windows in path/filepath

Original description

The description as published by the source.

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.6"},{"introduced":"1.20.0"},{"fixed":"1.20.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2022-41722 golang-1.15

References

advisory groups.google.com
advisory pkg.go.dev
report go.dev
report go.dev
web nvd.nist.gov