—

PYSEC-2022-223

Quick fix

PYSEC-2022-223 — mat2: upgrade to the fixed version with the command below.

pip install --upgrade 'mat2>=0.13.0'

Details

mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/mat2

Introduced in: 0Fixed in: 0.13.0

Fixpip install --upgrade 'mat2>=0.13.0'

References

https://0xacab.org/jvoisin/mat2/-/commit/beebca4bf1cd3b935824c966ce077e7bcf610385[WEB]
https://dustri.org/b/mat2-0130.html[WEB]
https://0xacab.org/jvoisin/mat2/-/issues/174[WEB]
https://github.com/advisories/GHSA-f33p-9287-h552[ADVISORY]