CVE-2017-0359: diffoscope Arbitrary Disk Write Vulnerability
Summary
CVE-2017-0359: diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive. Affects diffoscope versions < 77. Fixed in 77. How to fix ↓
Also tracked for
- diffoscope · Debian:11
The same CVE-2017-0359 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
diffoscope is a tool for in-depth comparison of files, archives, and directories. It is written in Python and available on the Python Package Index (PyPI). diffoscope allows users to analyze the differences between two or more files, providing detailed information on content and structure. However, versions prior to 77 are vulnerable to an arbitrary disk write issue, which can be exploited by an attacker through a malicious archive. This vulnerability poses a significant risk as it allows an attacker to write arbitrary data to disk, potentially leading to unauthorized access, data corruption, or system compromise.
Vulnerability Detail
The vulnerability in diffoscope (CVE-2017-0359) arises from the tool's failure to properly handle untrusted archives. When processing an untrusted archive, diffoscope writes data to arbitrary locations on disk based on the contents of the archive. This can be exploited by an attacker to overwrite critical files or inject malicious code into the system. The vulnerability was addressed in version 77 of diffoscope, which introduced proper handling of untrusted archives to prevent arbitrary disk writes.
How To Fix
Latest published version: 332.0.0 as of 22 Oct 2026
pip install --upgrade "diffoscope==332.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
77
This is the first release that contains the fix.
pip install --upgrade "diffoscope==77"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The diffoscope Arbitrary Disk Write Vulnerability (CVE-2017-0359) allows an attacker to write arbitrary data to disk by exploiting the tool's improper handling of untrusted archives. This can lead to unauthorized access, data corruption, or system compromise. To mitigate this risk, it is crucial to update diffoscope to version 77 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for diffoscope →
FAQ
diffoscope is a Python tool used for comparing files, archives, and directories in a detailed manner. It provides insights into the differences between two or more files, including content and structural variations.
The vulnerability allows an attacker to write arbitrary data to disk, which can lead to unauthorized access, data corruption, or system compromise. It is crucial to update to a patched version of diffoscope to mitigate this risk.
You can use Vulert's playground at Vulert Scanner to check if your version of diffoscope is affected by this vulnerability. Simply upload your Pipfile.lock and Vulert will analyze it for any open-source vulnerabilities, including this one.
No specific workaround is available for this vulnerability. It is recommended to update to a patched version of diffoscope as soon as possible.
You can find more information about this vulnerability in the diffoscope advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/diffoscope/PYSEC-2018-83.yaml
Related vulnerabilities
Recent vulnerabilities recorded for diffoscope.
