-
Notifications
You must be signed in to change notification settings - Fork 36
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Directory traversal vulnerability from libzip #54
Comments
The variable |
|
Well the hyperbole isn't motivating to look into the issue.
The operating system enforces access rights... |
Understood but any progress or what is the plan with this issue? Still open and vulnerability tools marks all versions. |
Hi is there any update on this because our builds started failing because of CVE-2020-23171? |
Some guidance on remedial actions has been collected, for example, in https://snyk.io/research/zip-slip-vulnerability. |
Hi guys, it's false positive. See jeremylong/DependencyCheck#3594. |
How can that be a FP if the reported @jiahao42 attached a reproducer? Has anyone tested it? |
The linked DependencyCheck project is doing a poor job matching CPEs and has attributed the CVE for this issue to an unrelated Java library. That's the FP that @rposkocil is referring to and what brought me here, but the FP report in that project should not be interpreted to mean that this issue is false. |
Just to clarify, we can ignore jeremylong/DependencyCheck#3594 (FP is their problem) and keep tracking this actual security bug with |
@StayPirate I'm not a Nim user; with that caveat, yes I agree with you. |
@Araq could you share some extra information about how the upstream is going to address this issue? |
I must say that without diminishing the exploitability of this that This is the same for other languages that provide wrappers around libzip's What would be the proposed 'fix' for this CVE? Removing the |
Shouldn't this bug be moved into |
libzip doesn't provide an |
Issue
Given a crafted zip file containing a file of filename
../../../../../../../../tmp/evil.txt
, zip will extract the file to/tmp/evil.txt
, while actually it should be extracted to./tmp/evil.txt
. This vulnerability could allow the attacker to write a file to an arbitrary directory.How to reproduce
You can try to reproduce this vulnerability using this zip file, note that the symbol
nim -d:useLibzipSrc
is needed for compilation. You can find the PoC hereThe text was updated successfully, but these errors were encountered: