CVE-2022-23531 Arbitrary file write when scanning a specially-crafted local PyPI package

2022-12-1623:41:15

CWE-23

GitHub_M

www.cve.org

cve-2022-23531

arbitrary file write

guarddog tool

pypi package

path traversal

tarfile.extractall

vulnerability

patched version

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

0.001 Low

EPSS

Percentile

26.6%

JSON

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.

CNA Affected

[
  {
    "vendor": "DataDog",
    "product": "guarddog",
    "versions": [
      {
        "version": "< 0.1.5",
        "status": "affected"
      }
    ]
  }
]