PT-2021-23129 · Tough · Tough

Jkuf · Published 2021-10-19 · Updated 2021-10-25 · CVE-2021-41149

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions tough versions prior to 0.12.0

Description The tough library does not properly sanitize target names when caching a repository or saving specific targets to an output directory. This could allow files to be overwritten with arbitrary content anywhere on the system.

Recommendations For versions prior to 0.12.0, update to version 0.12.0 to resolve the issue. At the moment, there is no information about other workarounds for this issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-41149

GHSA-X3R5-Q6MJ-M485

Affected Products

Tough

References · 7

• https://github.com/awslabs/tough/commit/1809b9bd1106d78a51fbea3071aa97a3530bac9a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41149 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41149 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3r5-q6mj-m485 · Vendor Advisory
• https://github.com/awslabs/tough · Note
• https://github.com/awslabs/tough/security/advisories/GHSA-x3r5-q6mj-m485 · Note
• https://t.me/cibsecurity/30832 · Telegram Post