CVE-2020-29529

Опубликовано: 03 дек. 2020

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

Ссылки

https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0
Patch
Release Notes
Third Party Advisory
https://github.com/hashicorp/go-slug/pull/12
Patch
Third Party Advisory
https://github.com/hashicorp/go-slug/releases/tag/v0.5.0
Release Notes
Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug
Exploit
Third Party Advisory
https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0
Patch
Release Notes
Third Party Advisory
https://github.com/hashicorp/go-slug/pull/12
Patch
Third Party Advisory
https://github.com/hashicorp/go-slug/releases/tag/v0.5.0
Release Notes
Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:hashicorp:go-slug:*:*:*:*:*:*:*:*

Версия до 0.5.0 (исключая)

EPSS

Процентиль: 63%

0.0045

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2020-29529

CVSS3: 7.5

ubuntu

около 5 лет назад

CVE-2020-29529

CVSS3: 7.5

redhat

около 5 лет назад

CVE-2020-29529

CVSS3: 7.5

debian

около 5 лет назад

HashiCorp go-slug up to 0.4.3 did not fully protect against directory ...

GHSA-2g5j-5x95-r6hr

CVSS3: 7.5

github

около 3 лет назад

Unsafe tar unpacking in HashiCorp go-slug

EPSS

Процентиль: 63%

0.0045

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22