CVE-2024-0406
Mholt/archiver: path traversal vulnerability
MEDIUM 6.1
En bref
- Source
- NVD
- EPSS
- EPSS 0.93 % · centile 60 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Analyzed
Description
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N | redhat |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-rhh4-rh7c-7r5v — Archiver Path Traversal vulnerability
- GO-2024-2698 — Archiver Path Traversal vulnerability in github.com/mholt/archiver
Références européennes
- ENISA EUVD · EUVD-2024-1299
- GCVE · GCVE-0-2024-0406
Avis du CERT-FR
- CERTFR-2025-AVI-0760 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0622 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0003 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mholt:archiver:*:*:*:*:*:*:*:*≥ 3.0.0 < 4.0.0cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*≥ 4.18 < 4.18.4
Produits affectés
| Produit | Versions |
|---|---|
| archiver | affected v3.0.0 < * ; unaffected v4.0.0 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202503051333.p0.g22b273d.assembly.stream.el9 < * |
| Red Hat · Red Hat Advanced Cluster Security 3 | |
| Red Hat · Red Hat Advanced Cluster Security 3 | |
| Red Hat · Red Hat Advanced Cluster Security 3 | |
| Red Hat · Red Hat Advanced Cluster Security 4 | |
| Red Hat · Red Hat Advanced Cluster Security 4 | |
| Red Hat · Red Hat Advanced Cluster Security 4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |