nvbn/thefuck · Security
The Fuck Arbitrary File Deletion via Path Traversal
- GHSA ID
- GHSA-8wwf-2644-f8x4
- CVE ID
- CVE-2021-34363
- Severity
- high
- Published
- Updated
- CVSS
- 9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- CVSS v3
- 9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- CVSS v4
- 8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Description
The thefuck (aka The Fuck) is app that corrects errors in previous console commands. The Fuck python package before 3.31 allows Path Traversal that leads to arbitrary file deletion via the undo archive operation feature.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-34363 ↗
- https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092 ↗
- https://github.com/nvbn/thefuck/releases/tag/3.31 ↗
- https://vuln.ryotak.me/advisories/48 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/thefuck/PYSEC-2021-97.yaml ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4MEDDLBFVRUQHPYIBJ4MFM3M4NUJUXL5 ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YA6UNQSOY6M3NJDZLS6YJXTS4WGDMEEJ ↗
- https://github.com/advisories/GHSA-8wwf-2644-f8x4 ↗