GO-2021-0099

    Dashboard / Vulnerabilities / GO-2021-0099

    GO-2021-0099

    Published: 14 Apr 2021Last Modified: 20 May 2024

    Summary: Zip slip directory exploit in github.com/deislabs/oras

    Details: Due to improper path validation, using the github.com/deislabs/oras/pkg/content.FileStore content store may result in directory traversal during archive extraction, allowing a malicious archive to write paths to arbitrary paths that the process can write to.

    References: https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e

    Affected packages

    Package

    Name: github.com/deislabs/oras

    Purl: pkg:golang/github.com/deislabs/oras

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.9.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2021-0099 | CVE-DB