CVE-2022-23530
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package
描述
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten. This issue is patched in version 0.1.8. Potential workarounds include using a safer module, like zipfile, and validating the location of the extracted files and discarding those with malicious paths.
如何修補 CVE-2022-23530
要修補 CVE-2022-23530,請將受影響套件升級到下列已修補版本。
- —升級至 0.1.8 或更新版本
- —升級至 37c7d0767ba28f4df46117d478f97652594c491c 或更新版本
CVE-2022-23530 正在被利用嗎?
低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- from 0, < 0.1.8
- from 0, < 37c7d0767ba28f4df46117d478f97652594c491c | from 0, < 0.1.8
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L |
| osv | CVSS 3.1 | MEDIUM5.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |