GHSA-5g39-ppwg-6xx8

Go-huge-util vulnerable to path traversal when unzipping files

Source: GitHub Advisory Database (reviewed) High CVE-2023-28105

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/dablelv/go-huge-util	< 0.0.34	0.0.34

Details

As written in the advisory (Markdown source, shown as plain text).

Impact ZipSlip issue when use fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. Patches It has been fixed in v0.0.34, Please upgrade version to v0.0.34 or above. Workarounds No, users have to upgrade version. Specific Go Packages Affected github.com/dablelv/go-huge-util/zip References

References

External links from the advisory. They lead to third-party sites.

https://github.com/dablelv/go-huge-util/security/advisories/GHSA-5g39-ppwg-6xx8 web
https://nvd.nist.gov/vuln/detail/CVE-2023-28105 advisory
https://github.com/dablelv/go-huge-util/commit/0e308b0fac8973e6fa251b0ab095cdc5c1c0956b web
https://github.com/dablelv/go-huge-util package
https://pkg.go.dev/vuln/GO-2023-1640 web