CVE-2020-7667: Arbitrary File Write via Archive Extraction (Zip Slip) in github.com/sassoftware/go-rpmutils
Summary
CVE-2020-7667: Arbitrary File Write via Archive Extraction (Zip Slip) in github.com/sassoftware/go-rpmutils. Affects github.com/sassoftware/go-rpmutils versions < 0.1.0. Fixed in 0.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/sassoftware/go-rpmutils is a Go package that provides utilities for working with RPM (Red Hat Package Manager) files. It allows users to extract files from RPMs and perform various operations on them. However, a vulnerability has been discovered in the package that can lead to arbitrary file write when extracting RPMs with relative file paths.
Vulnerability Detail
The vulnerability (CVE-2020-7667) arises from improper path sanitization in go-rpmutils. When an RPM containing relative file paths is extracted, it can cause files to be written or overwritten outside of the intended target directory. This can potentially lead to unauthorized modification or deletion of files on the system. The issue stems from a lack of proper validation and sanitization of file paths during the extraction process.
How To Fix
Minimum fixed version
0.1.0
This is the first release that contains the fix.
go get github.com/sassoftware/go-rpmutils@v0.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the package as soon as possible.
Conclusion
The vulnerability (CVE-2020-7667) in github.com/sassoftware/go-rpmutils allows for arbitrary file write when extracting RPMs with relative file paths. This can lead to unauthorized modification or deletion of files on the system. To mitigate this vulnerability, users should update to version 0.1.0 or later of the go-rpmutils package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/sassoftware/go-rpmutils →
FAQ
The vulnerability allows an attacker to write or overwrite files outside of the intended target directory. This can potentially lead to unauthorized modification or deletion of files on the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and it will analyze your dependencies for any known vulnerabilities, including this one.
Yes, a fix is available in version 0.1.0 of the go-rpmutils package. It is recommended to update to this version or later to mitigate the vulnerability.
There are no known exploits for this vulnerability at the time of this report. However, it is important to update to the fixed version of the package to prevent any potential exploitation.
Unfortunately, there are no known mitigations for this vulnerability. It is recommended to update to the fixed version of the package as soon as possible.
