CVE-2020-36560: Path Traversal Vulnerability in go-unzip
Summary
CVE-2020-36560: go-unzip vulnerable to Path Traversal. Affects github.com/artdarek/go-unzip versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
go-unzip is a Go package that provides functionality for extracting files from zip archives. It is commonly used in Go applications to handle file compression and extraction. However, a vulnerability has been discovered in go-unzip that allows for path traversal attacks. This vulnerability arises from improper path sanitization, which can result in files being written or overwritten outside of the intended target directory.
Vulnerability Detail
The path traversal vulnerability in go-unzip allows an attacker to manipulate file paths within a zip archive to access files outside of the target directory. By crafting a malicious zip archive with relative file paths, an attacker can overwrite or create files in arbitrary locations on the file system. This can lead to unauthorized access, data leakage, or even remote code execution depending on the context in which go-unzip is used.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
go get github.com/artdarek/go-unzip@v2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of go-unzip as soon as possible.
Conclusion
The path traversal vulnerability in go-unzip can have serious security implications for applications that use this package. It is crucial to update to the latest version of go-unzip to mitigate the risk of path traversal attacks. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for github.com/artdarek/go-unzip →
FAQ
go-unzip is a Go package that provides functionality for extracting files from zip archives.
This vulnerability allows an attacker to write or overwrite files outside of the intended target directory, potentially leading to unauthorized access, data leakage, or remote code execution.
To fix this vulnerability, update your usage of go-unzip to version 1.0.0 or above.
There is no known workaround for this vulnerability. It is recommended to update to the latest version of go-unzip.
You can find more information about this vulnerability in the CVE-2020-36560 advisory or on the Vulert website.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
