GO-2024-2490
Path traversal in github.com/anchore/stereoscope
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-24579
- Alias
- GHSA-hpxr-w9w7-g4gv
Description
It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · github.com/anchore/stereoscope | introduced 0, fixed 0.0.1 |
Références
- https://github.com/anchore/stereoscope/security/advisories/GHSA-hpxr-w9w7-g4gv ADVISORY
- https://github.com/anchore/stereoscope/commit/09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |