GoogleOSV:CVE-2020-29529

HistoryDec 03, 2020 - 8:15 p.m.

CVE-2020-29529

2020-12-0320:15:11

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

56.5%

JSON

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

CPENameOperatorVersion
go-slugeq0.4.2
go-slugeq0.4.0
go-slugeq0.2.0
go-slugeq0.3.0
go-slugeq0.3.1
go-slugeq0.4.1
go-slugeq0.1.0
go-slugeq0.4.3

Name	Operator	Version
go-slug	eq	0.4.2
go-slug	eq	0.4.0
go-slug	eq	0.2.0
go-slug	eq	0.3.0
go-slug	eq	0.3.1
go-slug	eq	0.4.1
go-slug	eq	0.1.0
go-slug	eq	0.4.3

References

github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0

github.com/hashicorp/go-slug/pull/12

github.com/hashicorp/go-slug/releases/tag/v0.5.0

securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug