Описание
Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.
Impact
A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory.
Patches
Please use version 4.0.0 or later github.com/codeclysm/extract/v4. Any previous version is affected by the bug.
Workarounds
No knows workarounds.
Backward compatibility notes about upgrading to /v4 from /v3
If you're not using the extract.Extractor.FS interface, you will not face any breaking changes and upgrading should be as simple as changing the import to /v4. This should be the case for most of the userbase.
If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added:
There should be no other breaking changes in the /v4 API.
Пакеты
github.com/codeclysm/extract/v3
<= 3.1.1
Отсутствует
github.com/codeclysm/extract/v4
< 4.0.0
4.0.0
github.com/codeclysm/extract
<= 2.2.0
Отсутствует
EPSS
6.9 Medium
CVSS4
5.3 Medium
CVSS3
CVE ID
Дефекты
Связанные уязвимости
Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.
EPSS
6.9 Medium
CVSS4
5.3 Medium
CVSS3