CVE-2022-25856

Source

https://nvd.nist.gov/vuln/detail/CVE-2022-25856

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25856.json

Aliases

• GHSA-qpgx-64h2-gc3c
• GO-2022-0492
• SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522

Published

2022-06-17T20:15:10Z

Modified

2023-11-29T09:30:49.935062Z

Details

The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ...

References

• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522
• https://github.com/argoproj/argo-events/issues/1947
• https://github.com/argoproj/argo-events/commit/d0f66dbce78bc31923ca057b20fc722aa24ca961