HIGH 7.5
GHSA-62jx-8vmh-4mcw
Links in archive can create arbitrary directories
상세
When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
참고
- https://nvd.nist.gov/vuln/detail/CVE-2021-38511 [ADVISORY]
- https://github.com/alexcrichton/tar-rs/issues/238 [WEB]
- https://github.com/alexcrichton/tar-rs/pull/259 [WEB]
- https://github.com/alexcrichton/tar-rs [PACKAGE]
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tar/RUSTSEC-2021-0080.md [WEB]
- https://rustsec.org/advisories/RUSTSEC-2021-0080.html [WEB]