Vulnerability · Published Sep 2, 2020 · Assigned by mitre

CVE-2020-24654

Low 3.3

In plain English

A low-severity security flaw in the ark package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)3.3Low

Exploit odds (30 days)1.5%top 25.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	ark	20.08.0-r1	ALPINE-CVE-2020-24654
Alpine:v3.21	ark	20.08.0-r1	ALPINE-CVE-2020-24654
Alpine:v3.22	ark	20.08.0-r1	ALPINE-CVE-2020-24654
Alpine:v3.23	ark	20.08.0-r1	ALPINE-CVE-2020-24654
Alpine:v3.24	ark	20.08.0-r1	ALPINE-CVE-2020-24654
Debian:12	ark	4:20.08.1-1	DEBIAN-CVE-2020-24654
Debian:13	ark	4:20.08.1-1	DEBIAN-CVE-2020-24654
Debian:14	ark	4:20.08.1-1	DEBIAN-CVE-2020-24654

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

openSUSE-SU-2020:1310 vendor-advisory, x_refsource_SUSE
https://github.com/KDE/ark/commit/8bf8c5ef07b0ac5e914d752681e470dea403a5bd x_refsource_CONFIRM
https://bugzilla.suse.com/show_bug.cgi?id=1175857 x_refsource_CONFIRM
https://kde.org/info/security/advisory-20200827-1.txt x_refsource_CONFIRM
DSA-4759 vendor-advisory, x_refsource_DEBIAN
FEDORA-2020-c2f8a1e8a5 vendor-advisory, x_refsource_FEDORA
USN-4482-1 vendor-advisory, x_refsource_UBUNTU
FEDORA-2020-f04f41bcc9 vendor-advisory, x_refsource_FEDORA
GLSA-202010-06 vendor-advisory, x_refsource_GENTOO
GLSA-202101-06 vendor-advisory, x_refsource_GENTOO
[debian-lts-announce] 20220520 [SECURITY] [DLA 3015-1] ark security update mailing-list, x_refsource_MLIST