PT-2017-3650 · Debian · Diffoscope

Ximin Luo · Published 2017-02-09 · Updated 2024-06-15 · CVE-2017-0359

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: diffoscope versions prior to 77

Description: The issue is related to a lack of necessary checks when analyzing archives, which can be exploited by a remote attacker to write data to arbitrary locations on disk using a specially crafted archive. This can potentially lead to unauthorized data modification.

Recommendations: For versions prior to 77, update to version 77 or later to resolve the issue. As a temporary workaround, consider restricting the use of diffoscope when analyzing untrusted archives until a patch is applied. Avoid using diffoscope to analyze archives from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-254

CWE-22

Related Identifiers

BDU:2018-00770

CVE-2017-0359

GHSA-8P5C-F328-9FVV

OPENSUSE-SU-2024:10717-1

PYSEC-2018-83

Affected Products

Diffoscope

References · 19

• 🔥 https://bugs.debian.org/854723 · Exploit
• https://bdu.fstec.ru/vul/2018-00770 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-0359 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-0359 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0359 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8p5c-f328-9fvv · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-0359 · Security Note
• https://osv.dev/vulnerability/PYSEC-2018-83 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0359 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10717-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-0359 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-0359 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/diffoscope/PYSEC-2018-83.yaml · Note
• https://github.com/anthraxx/diffoscope · Note
• https://github.com/anthraxx/diffoscope/commit/632a40828a54b399787c25e7fa243f732aef7e05 · Note