CVE-2021-21272: Improper Limitation of a Pathname to a Restricted Directory

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloade...

PT-2021-14379

Name of the Vulnerable Software and Affected Versions: ORAS versions 0.4.0 through 0.9.0 Description: The issue is related to a "zip-slip" vulnerability in the directory support feature of ORAS, which allows downloaded gzipped tarballs to be automatically extracted to a user-specified directory...