CVE-2020-7669 - Arbitrary File Write via Archive Extraction (Zip Slip)

Back Back to CVE browser

HIGH

Arbitrary File Write via Archive Extraction (Zip Slip)

Published Sep 1, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.83%

Description

This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.

Affected products

Vendor n/a Product Github.com/u-Root/u-Root/pkg/tarutil Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <unspecified

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Github.com/u-Root/u-Root/pkg/tarutil

n/a

Version	Status	Constraints
0	affected	<unspecified

Ecosystem	Package	Introduced	Fixed
Go	github.com/u-root/u-root	0	0.9.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (6)

https://github.com/advisories/GHSA-75qf-wgfj-v652
Advisory
https://github.com/u-root/u-root/issues/2449
https://github.com/u-root/u-root/pull/1817
x_refsource_MISCPatchThird Party Advisory
https://github.com/u-root/u-root/pull/2344
https://nvd.nist.gov/vuln/detail/CVE-2020-7669
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGTARUTIL-570428
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-75qf-wgfj-v652		Advisory
https://github.com/u-root/u-root/issues/2449
https://github.com/u-root/u-root/pull/1817		x_refsource_MISCPatchThird Party Advisory
https://github.com/u-root/u-root/pull/2344
https://nvd.nist.gov/vuln/detail/CVE-2020-7669
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGTARUTIL-570428		x_refsource_MISCExploitThird Party Advisory