GHSA-9423-6c93-gpp8

github.com/sassoftware/go-rpmutils Arbitrary File Write via Archive Extraction (Zip Slip)

Source: GitHub Advisory Database (reviewed) High CVE-2020-7667

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/sassoftware/go-rpmutils	< 0.1.0	0.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

The CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading `..` which leads in file extraction outside of the current directory. Note, the fixing commit was applied to all affected versions which were re-released.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7667 advisory
https://github.com/sassoftware/go-rpmutils/commit/a64058cf21b8aada501bba923c9aab66fb6febf0 web
https://github.com/sassoftware/go-rpmutils package
https://pkg.go.dev/vuln/GO-2020-0042 web
https://snyk.io/research/zip-slip-vulnerability web
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSASSOFTWAREGORPMUTILSCPIO-570427 web