PT-2022-16057 · Python+1 · Tarfile.Tarfile+1

Christophetd · Published 2022-12-02 · Updated 2023-06-27 · CVE-2022-23531

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GuardDog versions prior to 0.1.5

Description The issue allows an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned. This vulnerability exists by design in the tarfile.TarFile.extractall function. Running GuardDog against a specially-crafted package can exploit this vulnerability.

Recommendations Upgrade to GuardDog version 0.1.5 or more recent.

Exploit

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2022-23531

GHSA-RP2V-V467-Q9VQ

PYSEC-2022-42994

Affected Products

Guarddog

Tarfile.Tarfile

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23531.json · Exploit
• https://github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23531 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-42994 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23531 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rp2v-v467-q9vq · Vendor Advisory
• https://github.com/DataDog/guarddog · Note
• https://github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vq · Note
• https://github.com/DataDog/guarddog/releases/tag/v0.1.5 · Note
• https://github.com/DataDog/guarddog/pull/89 · Note
• https://github.com/DataDog/guarddog/commit/98af5c8c1e9c15fa888c900252e76116b0ec25d1 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/guarddog/PYSEC-2022-42994.yaml · Note
• https://t.me/cibsecurity/54794 · Telegram Post
• https://t.me/cvenotify/40422 · Telegram Post