CVE-2018-1103: Arbitrary file write via archive extraction in github.com/openshift/source-to-image
Summary
CVE-2018-1103: Arbitrary file write via archive extraction in github.com/openshift/source-to-image. Affects github.com/openshift/source-to-image versions < 1.1.10-0.20180427153919-f5cbcbc5cc6f. Fixed in 1.1.10-0.20180427153919-f5cbcbc5cc6f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/openshift/source-to-image, which is written in Go. It is a tool that allows users to build and deploy Docker images from source code. The package provides functionality for extracting files from archives. However, due to improper path sanitization, it is vulnerable to arbitrary file write attacks when extracting archives with relative file paths.
Vulnerability Detail
The vulnerability (CVE-2018-1103) arises from the package's failure to properly sanitize file paths during archive extraction. This allows an attacker to craft an archive containing relative file paths that can overwrite files outside of the intended target directory. The impact of this vulnerability can be significant, as it enables an attacker to modify or delete critical files on the system, potentially leading to unauthorized access, data loss, or system compromise.
How To Fix
Minimum fixed version
1.1.10-0.20180427153919-f5cbcbc5cc6f
This is the first release that contains the fix.
go get github.com/openshift/source-to-image@v1.1.10-0.20180427153919-f5cbcbc5cc6fTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version as soon as possible.
Conclusion
The vulnerability (CVE-2018-1103) in github.com/openshift/source-to-image allows for arbitrary file write attacks during archive extraction. To fix this vulnerability, it is crucial to update the package to version 1.1.10-0.20180427153919-f5cbcbc5cc6f or later. There are no known workarounds, and it is recommended to update the package as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/openshift/source-to-image →
FAQ
This vulnerability allows an attacker to write or overwrite files outside of the target directory, potentially leading to unauthorized access, data loss, or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it in real-time.
While specific exploits for this vulnerability may not be publicly available, the underlying issue is well-documented. It is important to update the package to the fixed version to mitigate the risk.
Yes, a patch is available in version 1.1.10-0.20180427153919-f5cbcbc5cc6f of the package. It is recommended to update to this version or later to fix the vulnerability.
No, updating the package to the fixed version is the only reliable way to mitigate the risk posed by this vulnerability.
