PT-2022-16057 · Guarddog+1 · Guarddog+1

Christophetd

·

CVE-2022-23531

·

Published

2022-12-02

·

Updated

2023-06-27

CVSS v3.1

5.8

Medium

VectorAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions GuardDog versions prior to 0.1.5
Description The issue allows an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned. This vulnerability exists by design in the tarfile.TarFile.extractall function. Running GuardDog against a specially-crafted package can exploit this vulnerability.
Recommendations Upgrade to GuardDog version 0.1.5 or more recent.

Exploit

Fix

DoS

Path traversal

Relative Path Traversal

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-22CWE-23

Related Identifiers

CVE-2022-23531
GHSA-RP2V-V467-Q9VQ
PYSEC-2022-42994

Affected Products

Guarddog
Tarfile.Tarfile