CVE-2020-7669

This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction...

CVE-2020-7669

CVE-2020-7669 affects the Go package github.com/u-root/u-root/pkg/tarutil, vulnerable to both leading and non-leading relative path traversal attacks during tar extraction (Zip Slip). The issue is present in versions prior to 0.7.0; the restoration of safe extraction is achieved by upgrading to n...

CVE-2020-7666 Arbitrary File Write via Archive Extraction (Zip Slip)

This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based relative and absolute path traversal attacks in cpio file extraction...

CVE-2020-7666

The CVE-2020-7666 entry concerns github.com/u-root/u-root/pkg/cpio, where the cpio extraction code is vulnerable to path traversal (leading and non-leading relative paths) and symlink-based traversal (relative and absolute) during archive extraction. Multiple sources describe this as Arbitrary Fi...

CVE-2020-7666

This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based relative and absolute path traversal attacks in cpio file extraction...

CVE-2020-7665

This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction...

CVE-2020-7665

CVE-2020-7665 affects all versions of github.com/u-root/u-root/pkg/uzip. The connected sources describe a path traversal (Zip Slip) flaw in zip extraction that can lead to arbitrary file writes outside the target directory. Practical impact stated: risk of writing files outside the intended locat...

CVE-2020-7665

This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction...

CVE-2020-7666

This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based relative and absolute path traversal attacks in cpio file extraction...

CVE-2020-7669

This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/u-root/u-root/pkg/uzip is a package that provides Go versions of standard Linux tools and bootloaders. It also provides tools for compiling Go programs in a single binary and creating initramfs images. Affected versions of this package are vulnerable to Arbitrary File Write vi...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/u-root/u-root/pkg/cpio is a package that provides Go versions of standard Linux tools and bootloaders. It also provides tools for compiling Go programs in a single binary and creating initramfs images. Affected versions of this package are vulnerable to Arbitrary File Write vi...

PT-2020-19693 · U Root · U-Root

Name of the Vulnerable Software and Affected Versions: u-root versions affected versions not specified Description: The issue concerns path traversal attacks, specifically both leading and non-leading relative path traversal, in zip file extraction. This affects the u-root package, particularly i...

PT-2020-19694 · U Root · U-Root

Name of the Vulnerable Software and Affected Versions: u-root versions prior to 7.0.0 Description: The issue affects the cpio file extraction in the u-root package, making it vulnerable to leading and non-leading relative path traversal attacks, as well as symlink-based path traversal attacks, bo...

CVE-2020-7666: Improper Limitation of a Pathname to a Restricted Directory

This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based relative and absolute path traversal attacks in cpio file extraction...

CVE-2020-7665: Improper Limitation of a Pathname to a Restricted Directory

This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction...

CVE-2020-7669: Improper Limitation of a Pathname to a Restricted Directory

This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction...

CVE-2010-2956: Undefined Security Weakness

Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence...