In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all affected versions which were re-released.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: snyk
Published: 2020-06-24T12:00:15.519943Z
Updated: 2024-09-17T02:48:08.483Z
Reserved: 2020-01-21T00:00:00
Link: CVE-2020-7667
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-06-24T12:15:12.677
Modified: 2024-11-21T05:37:34.447
Link: CVE-2020-7667
Redhat
No data.