Josegonzalez

**Name of the Vulnerable Software and Affected Versions** Dokku versions prior to 0.38.2 **Description** The `git:from-archive` and `certs:add` commands extract user-supplied tar or zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. Because GNU tar creates symlinks during extraction and follows them for subsequent entries, an attacker can write arbitrary files to any location writable by the dokku user, such as overwriting the `~/.ssh/authorized keys` file to obtain unrestricted shell access. **Recommendations** Update to version 0.38.2.

**Name of the Vulnerable Software and Affected Versions** Dokku versions prior to 0.38.2 **Description** The openresty-vhosts plugin copies files from an application's `openresty/http-includes/` git repository directory to the host. The plugin then interpolates these filenames, without escaping, into a single-quoted shell string that is subsequently processed by the `eval()` function. A filename containing a single quote can break the quoting mechanism, enabling command substitution to execute arbitrary commands on the host with the privileges of the dokku user during the next application deployment. **Recommendations** Update to version 0.38.2.

**Name of the Vulnerable Software and Affected Versions** Dokku versions prior to 0.38.2 **Description** The `git:auth` command creates the `$DOKKU ROOT/.netrc` file using the bash `touch` command, which applies a default umask of 0644. This process overrides the 0600 permission setting typically enforced by the netrc binary, allowing any local user with access to the dokku home directory to read sensitive git credentials. **Recommendations** Update to version 0.38.2.

**Name of the Vulnerable Software and Affected Versions** Dokku versions prior to 0.38.2 **Description** An issue exists where the app name validation regex permits shell metacharacters. An authenticated user can exploit this by pushing to a git remote using a crafted app name. This name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc in the `fn-git-create-hook()` function located at plugins/git/internal-functions:378. Consequently, bash interprets characters such as semicolons as command separators, allowing the execution of arbitrary commands as the dokku user. **Recommendations** Update Dokku to version 0.38.2.