Описание
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.
Отчет
This is a path traversal vulnerability in v3 of mhol/archiver and has been marked as moderate for a variety of reasons. First and foremost the attacker in order to exploit this vulnerability would require local files system/code execution level access, this cannot be exploited on a network level, secondly, the successful exploitation of this vulnerability only result in overwriting of files, not denial of service due to resource exhaustion and no code execution, keeping all these things in mind redhat has assigned this as moderate impact.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Advanced Cluster Security 3 | advanced-cluster-security/rhacs-main-rhel8 | Will not fix | ||
| Red Hat Advanced Cluster Security 3 | advanced-cluster-security/rhacs-roxctl-rhel8 | Will not fix | ||
| Red Hat Advanced Cluster Security 3 | advanced-cluster-security/rhacs-scanner-rhel8 | Will not fix | ||
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-main-rhel8 | Not affected | ||
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-roxctl-rhel8 | Not affected | ||
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-scanner-rhel8 | Not affected | ||
| Red Hat OpenShift Container Platform 4.18 | openshift4/oc-mirror-plugin-rhel9 | Fixed | RHSA-2025:2449 | 11.03.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.
EPSS
6.1 Medium
CVSS3