GHSA-hpxr-w9w7-g4gv

Source

https://github.com/advisories/GHSA-hpxr-w9w7-g4gv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-hpxr-w9w7-g4gv/GHSA-hpxr-w9w7-g4gv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hpxr-w9w7-g4gv

Aliases

Related

Published

2024-01-31T22:39:17Z

Modified

2024-02-13T18:41:49.059923Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator

Summary

stereoscope vulnerable to tar path traversal when processing OCI tar archives

Details

Impact

It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. Specifically, use of github.com/anchore/stereoscope/pkg/file.UntarToDirectory() function, the github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider struct, or the higher level github.com/anchore/stereoscope/pkg/image.Image.Read() function express this vulnerability.

Patches

Patched in v0.0.1

Workarounds

If you are using the OCI archive as input into stereoscope then you can switch to using an OCI layout by unarchiving the tar archive and provide the unarchived directory to stereoscope.

References

Patch PR https://github.com/anchore/stereoscope/pull/214

Database specific

{
    "nvd_published_at": "2024-01-31T17:15:40Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-31T22:39:17Z"
}

References

Affected packages

Go / github.com/anchore/stereoscope

Package

Name: github.com/anchore/stereoscope; View open source insights on deps.dev
Purl: pkg:golang/github.com/anchore/stereoscope

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.1