Design/Logic Flaw

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

CVE-2020-7667

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

CVE-2020-7667: Improper Limitation of a Pathname to a Restricted Directory

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

PT-2020-19695

Name of the Vulnerable Software and Affected Versions go-rpmutils/cpio version 0.1.0 and earlier Description The CPIO extraction functionality does not sanitize the paths of the archived files for leading and non-leading .., which leads to file extraction outside of the current directory. This is...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/sassoftware/go-rpmutils/cpio is a package for parsing and extracting content from RPM files. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. The CPIO extraction functionality doesn't sanitize the paths of the archived...