What is GHSA-c2cc-3569-6jh2?

GHSA-c2cc-3569-6jh2 is a security advisory published by GitHub Security Advisories with High severity. Path traversal in ZIPFoundation

Which CVE IDs does GHSA-c2cc-3569-6jh2 cover?

GHSA-c2cc-3569-6jh2 covers the following CVE IDs: CVE-2023-39138. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c2cc-3569-6jh2?

GHSA-c2cc-3569-6jh2 has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-c2cc-3569-6jh2?

GHSA-c2cc-3569-6jh2 affects 1 product, including: swift/github.com/weichsel/ZIPFoundation:\u003c= 0.9.17.

GHSA-c2cc-3569-6jh2HighCVSS 7.8

Path traversal in ZIPFoundation

Vendor

GitHub Security Advisories

Published

August 31, 2023

Last Modified

February 9, 2024

🔗 CVE IDs covered (1)

CVE-2023-39138 →

📋 Description

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.

🎯 Affected products1

swift/github.com/weichsel/ZIPFoundation:<= 0.9.17

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2023-39138
https://github.com/weichsel/ZIPFoundation/issues/282
https://blog.ostorlab.co/zip-packages-exploitation.html
https://ostorlab.co/vulndb/advisory/OVE-2023-4
https://ostorlab.co/vulndb/advisory/OVE-2023-6
https://github.com/weichsel/ZIPFoundation/releases/tag/0.9.18
https://github.com/advisories/GHSA-c2cc-3569-6jh2