~ / search / GHSA-x3r5-q6mj-m485

GHSA-x3r5-q6mj-m485

Improper sanitization of target names

Source: GitHub Advisory Database (reviewed) High CVE-2021-41149

Packages

EcosystemPackageAffectedFixed in
crates.io tough < 0.12.0 0.12.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system. AWS would like to thank https://github.com/jku for reporting this issue. ### Patches A fix is available in version 0.12.0. ### Workarounds No workarounds to this issue are known.

References

External links from the advisory. They lead to third-party sites.