PT-2023-21563 · Unknown · Go-Used-Util

Cokebeer · Publicado 2023-03-16 · Atualizado 2023-08-23 · CVE-2023-28105

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions go-used-util versions prior to 0.0.34

Description The issue is a ZipSlip problem that occurs when using the fsutil package to unzip files. This can lead to path traversal when users use zip.Unzip to unzip zip files from a malicious attacker.

Recommendations For versions prior to 0.0.34, upgrade to version 0.0.34 or above to fix the issue. As a temporary workaround, consider avoiding the use of the zip.Unzip function from the github.com/dablelv/go-huge-util/zip package until the upgrade is applied.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-28105

GHSA-5G39-PPWG-6XX8

GO-2023-1640

Produtos afetados

Go-Used-Util

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28105.json · Exploit
• https://github.com/dablelv/go-huge-util · Nota
• https://github.com/dablelv/go-huge-util/commit/0e308b0fac8973e6fa251b0ab095cdc5c1c0956b · Correção
• https://github.com/dablelv/go-huge-util/security/advisories/GHSA-5g39-ppwg-6xx8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-28105 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5g39-ppwg-6xx8 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1640 · Aviso do Fabricante
• https://t.me/cvenotify/46347 · Publicação no Telegram
• https://t.me/cibsecurity/60167 · Publicação no Telegram
• https://pkg.go.dev/vuln/GO-2023-1640 · Nota
• https://osv.dev/vulnerability/CVE-2023-28105 · Aviso do Fabricante