CVE-2023-28105: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

March 16, 2023 (updated August 23, 2023)

go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.

References

github.com/advisories/GHSA-5g39-ppwg-6xx8
github.com/dablelv/go-huge-util/commit/0e308b0fac8973e6fa251b0ab095cdc5c1c0956b
github.com/dablelv/go-huge-util/security/advisories/GHSA-5g39-ppwg-6xx8
nvd.nist.gov/vuln/detail/CVE-2023-28105

Code Behaviors & Features

Detect and mitigate CVE-2023-28105 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →