What is GHSA-v9j4-cp63-qv62?

GHSA-v9j4-cp63-qv62 is a security advisory published by GitHub Security Advisories with Critical severity. Tarslip in go-unarr

Which CVE IDs does GHSA-v9j4-cp63-qv62 cover?

GHSA-v9j4-cp63-qv62 covers the following CVE IDs: CVE-2021-38197. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v9j4-cp63-qv62?

GHSA-v9j4-cp63-qv62 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-v9j4-cp63-qv62?

GHSA-v9j4-cp63-qv62 affects 1 product, including: go/github.com/gen2brain/go-unarr:\u003c 0.1.4.

GHSA-v9j4-cp63-qv62CriticalCVSS 9.8

Tarslip in go-unarr

Vendor

GitHub Security Advisories

Published

September 1, 2021

Last Modified

May 22, 2023

🔗 CVE IDs covered (1)

CVE-2021-38197 →

📋 Description

unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.

🎯 Affected products1

go/github.com/gen2brain/go-unarr:< 0.1.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-38197
https://github.com/gen2brain/go-unarr/issues/21
https://github.com/gen2brain/go-unarr/commit/239ec404d348280b50bbf671327709e8857fc5f4
https://github.com/gen2brain/go-unarr/releases/tag/v0.1.4
https://github.com/advisories/GHSA-v9j4-cp63-qv62