GitHub Advisoryadvisory · PyPI
GHSA-75mx-hw5q-pvx3 python-libarchive directory traversal
HIGH
Official page ↗
- Aliases
- CVE-2024-55587
- Ecosystem
- PyPI
- Packages
- python-libarchive
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-22
- Reviewed
- 2024-12-12
Affected packages
• PyPI python-libarchive: <= 4.2.1 (no fix yet)
Description
python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract.
Related
Alias · CVE (1)
- CVE-2024-55587 python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and… vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-55587 advisory
- https://github.com/smartfile/python-libarchive/issues/42 web
- https://github.com/smartfile/python-libarchive/pull/41 web
- https://github.com/smartfile/python-libarchive package
- https://github.com/smartfile/python-libarchive/blob/c7677411bfc4ab5701d343bc6ebd9e35c990e80e/libarchive/zip.py#L107 web