GHSA-75qf-wgfj-v652HighCVSS 7.5

github.com/u-root/u-root/pkg/tarutil Arbitrary File Write via Archive Extraction (Zip Slip)

Published
May 18, 2021
Last Modified
October 18, 2023

🔗 CVE IDs covered (1)

CVE-2020-7669 →

📋 Description

This affects all versions up to and including version 0.7.0 of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.

🎯 Affected products1

  • go/github.com/u-root/u-root:< 0.9.0

🔗 References (6)