CVE-2024-47877
Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.
概要
Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com