PT-2017-3650 · Debian · Diffoscope

Ximin Luo · Publicado 2017-02-09 · Atualizado 2024-06-15 · CVE-2017-0359

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: diffoscope versions prior to 77

Description: The issue is related to a lack of necessary checks when analyzing archives, which can be exploited by a remote attacker to write data to arbitrary locations on disk using a specially crafted archive. This can potentially lead to unauthorized data modification.

Recommendations: For versions prior to 77, update to version 77 or later to resolve the issue. As a temporary workaround, consider restricting the use of diffoscope when analyzing untrusted archives until a patch is applied. Avoid using diffoscope to analyze archives from untrusted sources to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-254

CWE-22

Identificadores relacionados

BDU:2018-00770

CVE-2017-0359

GHSA-8P5C-F328-9FVV

OPENSUSE-SU-2024:10717-1

PYSEC-2018-83

Produtos afetados

Diffoscope

Referências · 19

• 🔥 https://bugs.debian.org/854723 · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/diffoscope/PYSEC-2018-83.yaml · Nota
• https://github.com/anthraxx/diffoscope · Nota
• https://github.com/anthraxx/diffoscope/commit/632a40828a54b399787c25e7fa243f732aef7e05 · Nota
• https://github.com/anthraxx/diffoscope/commit/f379d1f611dbd5d361e12b732e07c8aee45ff226 · Nota
• https://bdu.fstec.ru/vul/2018-00770 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-0359 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-0359 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-0359 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-0359 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8p5c-f328-9fvv · Aviso do Fabricante
• https://github.com/advisories/GHSA-8p5c-f328-9fvv · Nota
• https://cve.org/CVERecord?id=CVE-2017-0359 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2018-83 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0359 · Nota de Segurança