GHSA-8wwf-2644-f8x4

Source

https://github.com/advisories/GHSA-8wwf-2644-f8x4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-8wwf-2644-f8x4/GHSA-8wwf-2644-f8x4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8wwf-2644-f8x4

Aliases

Published

2021-06-15T15:49:01Z

Modified

2024-11-13T23:23:21.007345Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

The Fuck Arbitrary File Deletion via Path Traversal

Details

The thefuck (aka The Fuck) is app that corrects errors in previous console commands. The Fuck python package before 3.31 allows Path Traversal that leads to arbitrary file deletion via the undo archive operation feature.

Database specific

{
    "nvd_published_at": "2021-06-10T11:15:00Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-14T19:25:06Z"
}

References

Affected packages

PyPI / thefuck

Package

Name: thefuck; View open source insights on deps.dev
Purl: pkg:pypi/thefuck

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.31

Affected versions

0.*

0.1

Other

1dev

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.11

1.12

1.13

1.14

1.15

1.16

1.17

1.18

1.19

1.20

1.21

1.22

1.23

1.26

1.27

1.28

1.29

1.30

1.31

1.32

1.33

1.34

1.35

1.36

1.37

1.38

1.39

1.40

1.41

1.42

1.43

1.44

1.45

1.46

1.47

1.48

1.49

1.49.1

2.*

2.0

2.1

2.2

2.3

2.4

2.5

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.6

2.7

2.8

2.9

2.9.1

3.*

3.0

3.1

3.2

3.3

3.4

3.5

3.6

3.7

3.8

3.9

3.10

3.11

3.12

3.13

3.14

3.15

3.16

3.17

3.18

3.19

3.20

3.21

3.22

3.23

3.24

3.25

3.26

3.27

3.28

3.29

3.30