Log in Start free

Vulnerability · Published Apr 6, 2024 · Assigned by redhat

CVE-2024-0406Mholt/archiver: path traversal vulnerability

Medium 6.1

In plain English

A medium-severity path traversal in archiver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.9%top 39.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/mholt/archiverno fix listedGHSA-rhh4-rh7c-7r5v
Gogithub.com/mholt/archiverno fix listedGO-2024-2698
Gogithub.com/mholt/archiver/v3no fix listedGHSA-rhh4-rh7c-7r5v
Gogithub.com/mholt/archiver/v3no fix listedGO-2024-2698

Affected products (as reported)

VendorProductVersions
archiver v3.0.0 – before *
Red Hat Red Hat OpenShift Container Platform 4.18 see references
Red Hat Red Hat Advanced Cluster Security 3 see references
Red Hat Red Hat Advanced Cluster Security 3 see references
Red Hat Red Hat Advanced Cluster Security 3 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Advanced Cluster Security 4 see references

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

References