GitHub Advisoryadvisory · Go

GHSA-5g39-ppwg-6xx8 Go-huge-util vulnerable to path traversal when unzipping files

HIGH Published 2023-03-16 Modified 2023-10-02 Official page ↗
Aliases
CVE-2023-28105
Ecosystem
Go
Packages
github.com/dablelv/go-huge-util
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
Weaknesses
CWE-22
Reviewed
2023-03-16

Affected packages

• Go github.com/dablelv/go-huge-util: < 0.0.34 → fixed in 0.0.34

Description

Impact ZipSlip issue when use fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. Patches It has been fixed in v0.0.34, Please upgrade version to v0.0.34 or above. Workarounds No, users have to upgrade version. Specific Go Packages Affected github.com/dablelv/go-huge-util/zip References

Related

Alias · CVE (1)

  • CVE-2023-28105 go-used-util has commonly used utility functions for Go. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References