brendan-duncan/archive · Security
Filename spoofing in archive
- GHSA ID
- GHSA-r285-q736-9v95
- CVE ID
- CVE-2023-39137
- Severity
- high
- Published
- Updated
- CVSS
- 7.8 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3
- 7.8 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.
CWEs
- CWE-20 · Improper Input Validation
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-39137 ↗
- https://github.com/brendan-duncan/archive/issues/266 ↗
- https://blog.ostorlab.co/zip-packages-exploitation.html ↗
- https://ostorlab.co/vulndb/advisory/OVE-2023-3 ↗
- https://github.com/brendan-duncan/archive/commit/0d17b270a3c33d3bed56cadd9a43da7717ab11f4 ↗
- https://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_name_spoofing ↗
- https://github.com/advisories/GHSA-r285-q736-9v95 ↗