CVE-2020-29529

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

2.82% chance of exploitation in the next 30 days, 86th percentile

Published

2020-12-03

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug

Security advisories

• hashicorp/go-slug/pull/12
• advisories/GHSA-2g5j-5x95-r6hr

References

• CVE Record
• NVD entry