Path Traversal

2021-03-2501:44:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

39.9%

JSON

github.com/ipfs/go-ipfs is vulnerable to path traversal. The use of whyrusleeping/tar-utils which fails to validate tarPath when a get is done on an malicious DAG file allows overwritting of files or writing to incorrect destination folders during retrieval.

CPENameOperatorVersion
github.com/ipfs/go-ipfslev0.7.0
github.com/whyrusleeping/tar-utilseqHEAD
go-ipfs:edgeeq0.4.23-r0
go-ipfs:edgeeq0.5.1-r0
go-ipfs:edgeeq0.5.0-r1
go-ipfs:3.13eq0.7.0-r0

Name	Operator	Version
github.com/ipfs/go-ipfs	le	v0.7.0
github.com/whyrusleeping/tar-utils	eq	HEAD
go-ipfs:edge	eq	0.4.23-r0
go-ipfs:edge	eq	0.5.1-r0
go-ipfs:edge	eq	0.5.0-r1
go-ipfs:3.13	eq	0.7.0-r0