CVE-2024-11944

Опубликовано: 30 дек. 2024

Источник: nvd

CVSS3: 7.5

CVSS3: 8.8

EPSS Низкий

Описание

The specific flaw exists within the tarfile.extractall method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-25626.

Ссылки

https://www.truenas.com/docs/core/13.0/gettingstarted/corereleasenotes/#130-u63
Release Notes
https://www.zerodayinitiative.com/advisories/ZDI-24-1643/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:ixsystems:truenas_firmware:13.0:-:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:beta1:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:rc1:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u1:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u1.1:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u2:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u3:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u3.1:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u4:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u5:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u5.1:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u5.2:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u5.3:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u6:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u6.1:*:*:*:*:*:*

cpe:2.3:o:ixsystems:truenas_firmware:13.0:u6.2:*:*:*:*:*:*

cpe:2.3:h:ixsystems:truenas:-:*:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.00929

Низкий

7.5 High

CVSS3

8.8 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

GHSA-xpwc-vww2-w3pr

CVSS3: 7.5

github

около 1 года назад

iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tarfile.extractall method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-25626.

BDU:2025-00542

CVSS3: 7.5

fstec

около 1 года назад

Уязвимость метода tarfile.extractall операционной системы TrueNAS CORE, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 76%

0.00929

Низкий

7.5 High

CVSS3

8.8 High

CVSS3

Дефекты

CWE-22