CVE-2021-41149
Improper sanitization of target names
8.2
HIGH
CVSS 3.1
EPSS 1.1%
描述
### Impact The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system. AWS would like to thank https://github.com/jku for reporting this issue. ### Patches A fix is available in version 0.12.0. ### Workarounds No workarounds to this issue are known.
如何修補 CVE-2021-41149
要修補 CVE-2021-41149,請將受影響套件升級到下列已修補版本。
- —升級至 0.12.0 或更新版本
CVE-2021-41149 正在被利用嗎?
低 — EPSS 為 1.1%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 0.12.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.2 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N |