PT-2024-20466 · Unknown · Stereoscope

Wagoodman · Published 2024-01-31 · Updated 2024-02-13 · CVE-2024-24579

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions stereoscope versions prior to 0.0.1

Description It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. This issue is related to the use of the github.com/anchore/stereoscope/pkg/file.UntarToDirectory() function, the github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider struct, or the higher level github.com/anchore/stereoscope/pkg/image.Image.Read() function.

Recommendations As a temporary workaround, consider switching to using an OCI layout by unarchiving the tar archive and providing the unarchived directory to stereoscope. For versions prior to 0.0.1, update to version 0.0.1 to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-24579

GHSA-HPXR-W9W7-G4GV

GO-2024-2490

Affected Products

Stereoscope

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24579.json · Exploit
• https://github.com/anchore/stereoscope/commit/09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204 · Patch
• https://osv.dev/vulnerability/CVE-2024-24579 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24579 · Security Note
• https://osv.dev/vulnerability/GHSA-hpxr-w9w7-g4gv · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2490 · Vendor Advisory
• https://github.com/anchore/stereoscope · Note
• https://github.com/anchore/stereoscope/security/advisories/GHSA-hpxr-w9w7-g4gv · Note
• https://twitter.com/CVEnew/status/1752736624360751325 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1752789067777843250 · Twitter Post