PT-2020-19697 · U Root · U-Root

Georgios Gkitsas · Published 2020-09-01 · Updated 2024-08-21 · CVE-2020-7669

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions github.com/u-root/u-root/pkg/tarutil versions prior to 0.7.0

Description The issue affects the tar file extraction in the github.com/u-root/u-root/pkg/tarutil package, making it vulnerable to both leading and non-leading relative path traversal attacks. This can lead to arbitrary file write via archive extraction, also known as Zip Slip.

Recommendations For versions prior to 0.7.0, update to version 0.7.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the tar file extraction functionality in the affected package until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-7669

GHSA-75QF-WGFJ-V652

GO-2022-0805

SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGTARUTIL-570428

Affected Products

U-Root

References · 9

• 🔥 https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGTARUTIL-570428 · Exploit
• https://github.com/u-root/u-root/pull/1817 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-7669 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7669 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0805 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75qf-wgfj-v652 · Vendor Advisory
• https://github.com/u-root/u-root/issues/2449 · Note
• https://github.com/u-root/u-root/pull/2344 · Note
• https://github.com/advisories/GHSA-75qf-wgfj-v652 · Note