Path Traversal

🗓️ 25 Mar 2021 01:44:25Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 18 Views

github.com/ipfs/go-ipfs is vulnerable to path traversal due to inadequate validation of tarPath when retrieving malicious DAG files, leading to potential file overwriting or incorrect destination folder writing

Reporter	Title	Published	Views	Family All 12
AlpineLinux	CVE-2020-26279	24 Mar 202120:20	–	alpinelinux
CNNVD	Steven Allen go-ipfs 路径遍历漏洞	24 Mar 202100:00	–	cnnvd
CVE	CVE-2020-26279	24 Mar 202120:20	–	cve
Cvelist	CVE-2020-26279 Path traversal	24 Mar 202120:20	–	cvelist
EUVD	EUVD-2021-1239	7 Oct 202500:30	–	euvd
Github Security Blog	Path traversal in github.com/ipfs/go-ipfs	23 Jun 202117:27	–	github
NVD	CVE-2020-26279	24 Mar 202121:15	–	nvd
OSV	GHSA-27PV-Q55R-222G Path traversal in github.com/ipfs/go-ipfs	23 Jun 202117:27	–	osv
OSV	GO-2022-0779 Path traversal in github.com/ipfs/go-ipfs	21 Aug 202415:28	–	osv
Prion	Path traversal	24 Mar 202121:15	–	prion

Vulners

Node

protocol go-ipfsMatch0.5.1-r0go

AND

protocol go-ipfsMatch0.4.23-r0go

AND

protocol go-ipfsMatch0.5.0-r1go

AND

alpinelinux alpine_linuxMatchedge

protocol go-ipfsMatch0.7.0-r0go

AND

alpinelinux alpine_linuxMatch3.13

protocol github.com/ipfs/go-ipfsRangev0.4.20-rc1–0.4.20-rc1go

whyrusleeping github.com/whyrusleeping/tar-utilsMatchheadgo

Source	Link
github	www.github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227
github	www.github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2
github	www.github.com/ipfs/go-ipfs/security/advisories/GHSA-27pv-q55r-222g

27 Mar 2021 10:59Current

3.8Low risk

Vulners AI Score3.8

CVSS 3.17.7 - 8.1

CVSS 25.5

EPSS0.01624