Lucene search
Veracode Vulnerability DatabaseVERACODE:38532HistoryDec 20, 2022 - 4:10 a.m.
Path Traversal
2022-12-2004:10:05
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
5
path traversal
tarfile extraction
package scanner.
0.001 Low
EPSS
Percentile
26.6%
GuardDog is vulnerable to path traversal. The vulnerability exists due to the unsafe extraction using the tarfile.TarFile.extractall functionality in the scan_local function of package_scanner.py, which allows an attacker to write arbitrary files outside the destination directory through a malicious .tar.gz file.
References
github.com/DataDog/guarddog/commit/98af5c8c1e9c15fa888c900252e76116b0ec25d1
github.com/DataDog/guarddog/pull/89
github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306
github.com/DataDog/guarddog/releases/tag/v0.1.5
github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vq
Related
osv
osv
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted PyPI package
2022-12-02 22:25:25
CVE-2022-23531
2022-12-17 00:15:08
cve
cve
CVE-2022-23531
2022-12-17 00:15:08
github
github
cvelist
cvelist
nvd
nvd
CVE-2022-23531
2022-12-17 00:15:08
prion
prion
Path traversal
2022-12-17 00:15:00
thn
thn
Atlassian Releases Patches for Critical Flaws in Confluence and Bamboo
2023-07-25 04:17:00