CVE-2020-29529

CVE-2020-29529 affects HashiCorp go-slug up to 0.4.3, where directory traversal during tar unpacking could be bypassed via multiple symlinks. Root cause: insufficient protection when unpacking archives. Impact: potential exposure of restricted files; not fully protected. Fix: upstream in 0.5.0. R...

CVE-2020-29529

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0...

CVE-2020-29529

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0...

PT-2020-17183 · Hashicorp · Go-Slug

Name of the Vulnerable Software and Affected Versions: HashiCorp go-slug versions 0.4.3 and earlier Description: The issue allows a malicious attacker to bypass protections against directory traversal during archive extraction by chaining multiple symbolic links within the archive. This enables t...

Hashicorp Go-slug Path Traversal Vulnerability

Hashicorp Go-slug is a Go-based codebase for packing and unpacking files from the US company Hashicorp. A path traversal vulnerability exists in HashiCorp go-slug versions prior to 0.5.0, which stems from will not handle directory traversal attempts and symbolic links involving... / directory...