CVE-2024-24579 Tar path traversal in stereoscope when processing OCI tar archives

2024-01-3116:40:35

CWE-22

GitHub_M

www.cve.org

cve-2024-24579; tar path traversal; stereoscope; oci tar archives; vulnerability; file writing paths; temporary directory; workaround; oci layout; unarchiving.

5.3 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.5%

JSON

stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. Specifically, use of github.com/anchore/stereoscope/pkg/file.UntarToDirectory() function, the github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider struct, or the higher level github.com/anchore/stereoscope/pkg/image.Image.Read() function express this vulnerability. As a workaround, if you are using the OCI archive as input into stereoscope then you can switch to using an OCI layout by unarchiving the tar archive and provide the unarchived directory to stereoscope.

CNA Affected

[
  {
    "vendor": "anchore",
    "product": "stereoscope",
    "versions": [
      {
        "version": "< 0.0.1",
        "status": "affected"
      }
    ]
  }
]