PT-2024-36562 · Unknown · Python-Libarchive

Csirttrizna · Published 2024-12-11 · Updated 2024-12-15 · CVE-2024-55587

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions python-libarchive versions 4.2.1 and earlier

Description The issue allows directory traversal, enabling the creation of files in extract in zip.py for ZipFile.extractall and ZipFile.extract functions. This can be exploited to create files outside the intended directory.

Recommendations For python-libarchive versions 4.2.1 and earlier, consider updating to a version that contains a fix for this issue. As a temporary workaround, restrict the use of the ZipFile.extractall and ZipFile.extract functions until a patch is available. Avoid using these functions with untrusted zip files to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-55587

GHSA-75MX-HW5Q-PVX3

Affected Products

Python-Libarchive

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-55587 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55587 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75mx-hw5q-pvx3 · Vendor Advisory
• https://github.com/smartfile/python-libarchive/blob/c7677411bfc4ab5701d343bc6ebd9e35c990e80e/libarchive/zip.py#L107 · Note
• https://github.com/smartfile/python-libarchive/pull/41 · Note
• https://github.com/smartfile/python-libarchive/issues/42 · Note
• https://github.com/smartfile/python-libarchive · Note
• https://twitter.com/CVEnew/status/1868271126268260610 · Twitter Post
• https://t.me/cvenotify/103966 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1866850666880159966 · Twitter Post