CVE-2020-7667: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

June 23, 2021 (updated January 4, 2022)

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn’t sanitize the paths of the archived files for leading and non-leading “..” which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all affected versions which were re-released.

References

github.com/advisories/GHSA-9423-6c93-gpp8
github.com/sassoftware/go-rpmutils/commit/a64058cf21b8aada501bba923c9aab66fb6febf0
nvd.nist.gov/vuln/detail/CVE-2020-7667

Code Behaviors & Features

Detect and mitigate CVE-2020-7667 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →