GHSA-98wx-cw86-c97x

mixlib-archive Path Traversal vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2017-1000026

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	mixlib-archive	< 0.4.0	0.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using `..` in tar archive entries

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-1000026 advisory
https://github.com/chef/mixlib-archive/pull/6 web
https://github.com/chef/mixlib-archive package
https://github.com/chef/mixlib-archive/blob/master/CHANGELOG.md web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mixlib-archive/CVE-2017-1000026.yml web