CVE-2024-54132

描述

The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.

如何修補 CVE-2024-54132

要修補 CVE-2024-54132,請將受影響套件升級到下列已修補版本。

• —未列出修補版本
• —未列出修補版本
• —未列出修補版本
• —升級至 2.63.1 或更新版本
• —升級至 2.63.1 或更新版本

CVE-2024-54132 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(5)

• from 0
• from 0, <= 1.14.0
• from 0
• from 0, < 2.63.1
• from 0, < 2.63.1

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-54132
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2024-54132
• PATCHgithub.com/cli/cli
• WEBgithub.com/cli/cli/commit/1136764c369aaf0cae4ec2ee09dc35d871076932
• WEB