Paper/Archive/CVE-2020-36566

CVE-2020-36566

github.com/whyrusleeping/tar-utils github.com/whyrusleeping/tar-utils — Path traversal in github.com/whyrusleeping/tar-utils

EPSS 1%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 65.9.659 × 2013.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

Affected

ProductAffectedFixed inSource

github.com/whyrusleeping/tar-utils< 0.0.0-20201201191210-20a61371de5b0.0.0-20201201191210-20a61371de5bCNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227 refsnyk.io/research/zip-slip-vulnerability refpkg.go.dev/vuln/GO-2021-0106