CVE-2020-29529

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-29529

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-29529.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-29529

Aliases

Downstream

DEBIAN-CVE-2020-29529

UBUNTU-CVE-2020-29529

Published

2020-12-03T20:15:11.820Z

Modified

2026-03-15T22:37:58.206663Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

References

Affected packages

Git / github.com/hashicorp/go-slug

Affected ranges

Type

GIT

Repo

https://github.com/hashicorp/go-slug

Events

Introduced

Fixed

28cafc59c8da6126a3ae94dfa84181df4073454f

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.5.0"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.2.0

v0.3.0

v0.3.1

v0.4.0

v0.4.1

v0.4.2

v0.4.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-29529.json"