GitHub Advisoryadvisory · PyPI
GHSA-8p5c-f328-9fvv Diffoscope may write to arbitrary locations due to an untrusted archive
CRITICAL
Official page ↗
- Aliases
- CVE-2017-0359
- Ecosystem
- PyPI
- Packages
- diffoscope
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-22
- Reviewed
- 2020-06-16
Affected packages
• PyPI diffoscope: < 76 → fixed in 76
Description
diffoscope before 76 writes to arbitrary locations on disk based on the contents of an untrusted archive.
Related
Alias · CVE (1)
- CVE-2017-0359 diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-0359 advisory
- https://github.com/anthraxx/diffoscope/commit/632a40828a54b399787c25e7fa243f732aef7e05 web
- https://github.com/anthraxx/diffoscope/commit/f379d1f611dbd5d361e12b732e07c8aee45ff226 web
- https://bugs.debian.org/854723 web
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723 web
- https://github.com/advisories/GHSA-8p5c-f328-9fvv advisory
- https://github.com/anthraxx/diffoscope package
- https://github.com/pypa/advisory-database/tree/main/vulns/diffoscope/PYSEC-2018-83.yaml web
- https://security-tracker.debian.org/tracker/CVE-2017-0359 web