Headline

GHSA-hpxr-w9w7-g4gv: stereoscope vulnerable to tar path traversal when processing OCI tar archives

Impact

It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. Specifically, use of github.com/anchore/stereoscope/pkg/file.UntarToDirectory() function, the github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider struct, or the higher level github.com/anchore/stereoscope/pkg/image.Image.Read() function express this vulnerability.

Patches

Patched in v0.0.1

Workarounds

If you are using the OCI archive as input into stereoscope then you can switch to using an OCI layout by unarchiving the tar archive and provide the unarchived directory to stereoscope.

References

Patch PR https://github.com/anchore/stereoscope/pull/214

10 months ago

ghsa

Open in Source

#vulnerability #git

GitHub Advisory Database
GitHub Reviewed
CVE-2024-24579

stereoscope vulnerable to tar path traversal when processing OCI tar archives

Moderate severity GitHub Reviewed Published Jan 31, 2024 in anchore/stereoscope • Updated Jan 31, 2024

Package

gomod github.com/anchore/stereoscope (Go)

Affected versions

< 0.0.1

Impact

It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. Specifically, use of github.com/anchore/stereoscope/pkg/file.UntarToDirectory() function, the github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider struct, or the higher level github.com/anchore/stereoscope/pkg/image.Image.Read() function express this vulnerability.

Patches

Patched in v0.0.1

Workarounds

If you are using the OCI archive as input into stereoscope then you can switch to using an OCI layout by unarchiving the tar archive and provide the unarchived directory to stereoscope.

References