What is GHSA-8459-6rc9-8vf8?

GHSA-8459-6rc9-8vf8 is a security advisory published by GitHub Security Advisories with Low severity. Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki

Why does GHSA-8459-6rc9-8vf8 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-8459-6rc9-8vf8?

GHSA-8459-6rc9-8vf8 affects 1 product, including: go/github.com/cloudflare/cfrpki:\u003c= 1.4.2.

GHSA-8459-6rc9-8vf8LowDisclosed before NVD

Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki

Vendor

GitHub Security Advisories

Published

February 14, 2022

Last Modified

November 7, 2023

📋 Description

Impact

In the case that a malicious TAL file is parsed pointing to a repository that provides a malicious ROA file which octorpki downloads, it is possible to bypass the current directory traversal mitigation to allow writing outside of the current directory.

Patches

No patch release has been made

🎯 Affected products1

go/github.com/cloudflare/cfrpki:<= 1.4.2

🔗 References (5)

https://github.com/cloudflare/cfrpki/security/advisories/GHSA-8459-6rc9-8vf8
https://github.com/cloudflare/cfrpki/commit/a053a808feeb3115c76b6cc263ee55598ce6e8cd
https://github.com/cloudflare/cfrpki/commit/eb9cc4db7b7b79e44f56dfaa959fccdfb2af8284
https://github.com/cloudflare/cfrpki/releases/tag/v1.4.3
https://github.com/advisories/GHSA-8459-6rc9-8vf8