Описание
Improper sanitization of target names
Impact
The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system.
AWS would like to thank https://github.com/jku for reporting this issue.
Patches
A fix is available in version 0.12.0.
Workarounds
No workarounds to this issue are known.
Пакеты
tough
< 0.12.0
0.12.0
Связанные уязвимости
Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.