GitHub Advisoryadvisory · Go
GHSA-8459-6rc9-8vf8 Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki
LOW
Official page ↗
- Ecosystem
- Go
- Packages
- github.com/cloudflare/cfrpki
- Severity
- Low
- Weaknesses
- CWE-22
- Reviewed
- 2022-02-14
Affected packages
• Go github.com/cloudflare/cfrpki: < 1.4.3 → fixed in 1.4.3
Description
Impact
In the case that a malicious TAL file is parsed pointing to a repository that provides a malicious ROA file which octorpki downloads, it is possible to bypass the current directory traversal mitigation to allow writing outside of the current directory.
Patches
No patch release has been made
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://github.com/cloudflare/cfrpki/security/advisories/GHSA-8459-6rc9-8vf8 web
- https://github.com/cloudflare/cfrpki/commit/a053a808feeb3115c76b6cc263ee55598ce6e8cd web
- https://github.com/cloudflare/cfrpki/commit/eb9cc4db7b7b79e44f56dfaa959fccdfb2af8284 web
- https://github.com/cloudflare/cfrpki package
- https://github.com/cloudflare/cfrpki/releases/tag/v1.4.3 web