Path traversal on Windows in path/filepath (CVE-2022-41722)

Résumé

Path traversal on Windows in path/filepath

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.6"},{"introduced":"1.20.0"},{"fixed":"1.20.1"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2022-41722 golang-1.15

Références

advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web pkg.go.dev