—

GO-2022-0787

Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer in github.com/datacharmer/dbdeployer

Quick fix

GO-2022-0787 — github.com/datacharmer/dbdeployer: upgrade to the fixed version with the command below.

go get github.com/datacharmer/dbdeployer@v1.58.2

Details

Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer in github.com/datacharmer/dbdeployer

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/datacharmer/dbdeployer

Introduced in: 0Fixed in: 1.58.2

Fixgo get github.com/datacharmer/dbdeployer@v1.58.2

References

https://github.com/datacharmer/dbdeployer/security/advisories/GHSA-47wr-426j-fr82[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2020-26277[ADVISORY]
https://github.com/datacharmer/dbdeployer/commit/548e256c1de2f99746e861454e7714ec6bc9bb10[FIX]