PT-2020-19694 · U Root · U-Root

Georgios Gkitsas · Published 2020-09-01 · Updated 2024-04-24 · CVE-2020-7666

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions u-root versions prior to 7.0.0

Description The issue affects the cpio file extraction in the u-root package, making it vulnerable to leading and non-leading relative path traversal attacks, as well as symlink-based path traversal attacks, both relative and absolute.

Recommendations For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-7666

GHSA-MQ35-X99R-54FC

SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGCPIO-570440

Affected Products

U-Root

References · 5

• 🔥 https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGCPIO-570440 · Exploit
• https://github.com/u-root/u-root/pull/1817 · Patch
• https://osv.dev/vulnerability/CVE-2020-7666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7666 · Security Note
• https://osv.dev/vulnerability/GHSA-mq35-x99r-54fc · Vendor Advisory