CVE-2018-1002207

Description

Arbitrary File Write via Archive Extraction in mholt/archiver in github.com/mholt/archiver

How to fix CVE-2018-1002207

To remediate CVE-2018-1002207, upgrade the affected package to a fixed version below.

• Go/github.com/mholt/archiver—upgrade to 2.1.0 or later
• Go/github.com/mholt/archiver—upgrade to 2.1.0+incompatible or later

Is CVE-2018-1002207 being exploited?

Low — EPSS is 2.6%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2.1.0
• from 0, < 2.1.0+incompatible

CVSS scores

References (8)

• ADVISORYgithub.com/advisories/GHSA-5wmg-j84w-4jj4
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-1002207
• PATCHgithub.com/mholt/archiver
• WEBgithub.com/mholt/archiver/commit/e4ef56d48eb029648b0e895bb0b6a393ef0829c3
• WEB