PT-2021-8851 · Cloud Foundry+3 · Archiver+3

Published 2021-04-14 · Updated 2023-06-08 · CVE-2018-25046

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue is caused by improper path sanitization, allowing archives with relative file paths to write or overwrite files outside the intended directory. This can lead to unauthorized file modifications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-25046

GHSA-32QH-8VG6-9G43

GO-2020-0025

Affected Products

Archiver

Code.Cloudfoundry.Org/Archiver

Code.Cloudfoundry.Org/Archiver/Extractor

Github.Com/Cloudfoundry/Archiver

References · 10

• https://github.com/cloudfoundry/archiver/commit/09b5706aa9367972c09144a450bb4523049ee840 · Patch
• https://osv.dev/vulnerability/CVE-2018-25046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25046 · Security Note
• https://osv.dev/vulnerability/GO-2020-0025 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-32qh-8vg6-9g43 · Vendor Advisory
• https://github.com/cloudfoundry/archiver · Note
• https://t.me/cibsecurity/55452 · Telegram Post
• https://t.me/cvenotify/40838 · Telegram Post
• https://snyk.io/research/zip-slip-vulnerability · Note
• https://pkg.go.dev/vuln/GO-2020-0025 · Note