CRITICAL9.1

GHSA-4vhw-4rw7-jfpv

Path traversal in mozwire

Details

An issue was discovered in the mozwire crate through 2020-08-18 for Rust. A ../ directory-traversal situation allows overwriting local files that have .conf at the end of the filename.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/mozwire

Introduced in: 0Fixed in: 0.5.0

Upgrade mozwire to 0.5.0 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-35883[ADVISORY]
https://github.com/NilsIrl/MozWire/issues/14[WEB]
https://github.com/NilsIrl/MozWire/pull/17/commits/dd0639bf2876773b66382f47285f7db701f628d9[WEB]
https://github.com/NilsIrl/MozWire[WEB]
https://rustsec.org/advisories/RUSTSEC-2020-0030.html[WEB]