CVE-2017-1000026.yml

---
gem: mixlib-archive
cve: 2017-1000026
ghsa: 98wx-cw86-c97x
url: https://github.com/chef/mixlib-archive/blob/master/CHANGELOG.md
title: mixlib-archive Path Traversal vulnerability
date: 2022-05-13
description: |
  Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable
  to a directory traversal attack allowing attackers to overwrite arbitrary files
  by using `..` in tar archive entries
cvss_v3: 7.5
patched_versions:
  - ">= 0.4.0"
related:
  url:
    - https://github.com/chef/mixlib-archive/pull/6