Links in archive can create arbitrary directories
When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-38511US | high7.5 | — | ||
An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/alexcrichton/tar-rsPACKAGE
- https://github.com/alexcrichton/tar-rs/issues/238WEB
- https://github.com/alexcrichton/tar-rs/pull/259WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-38511ADVISORY
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tar/RUSTSEC-2021-0080.mdWEB
- https://rustsec.org/advisories/RUSTSEC-2021-0080.htmlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan