Описание
Invoking "go tool pack" does not sanitize output paths in cmd/go
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| azl3 golang 1.27.1-1 on Azure Linux 3.0 | ||
| azl3 golang 1.27.0-1 on Azure Linux 3.0 |
Показывать по
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
The "go tool pack" subcommand (usually used only by the compiler as an ...
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
EPSS
5.9 Medium
CVSS3