GHSA-rhh4-rh7c-7r5v
Archiver Path Traversal vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2024-0406
- Aliases
- GO-2024-2698
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Description
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/mholt/archiver/v3 | introduced 3.0.0, last affected 3.5.1 |
| Go · github.com/mholt/archiver | introduced 3.0.0, last affected 3.5.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-0406 ADVISORY
- https://access.redhat.com/errata/RHSA-2025:2449 WEB
- https://access.redhat.com/security/cve/CVE-2024-0406 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2257749 WEB
- https://github.com/mholt/archiver PACKAGE
- https://pkg.go.dev/vuln/GO-2024-2698 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |