Описание
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
Summary
Various issues in bbot's unarchive.py allow a malicious site to cause bbot to write arbitrary files to arbitrary locations. This can be used to achieve Remote Code Execution (RCE).
Impact
A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.
Ссылки
Пакеты
Наименование
bbot
pip
Затронутые версииВерсия исправления
< 2.7.0
2.7.0
Связанные уязвимости
CVSS3: 9.6
nvd
4 месяца назад
BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.