Description (CNA)
Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Google / osv-scalibr | affected 0.1.3 before 0.1.8 |
CWE
CWE-427
References
- https://github.com/google/osv-scalibr/releases/tag/v0.1.8
- https://github.com/google/osv-scalibr/commit/2444419b1818c2d6917fc3394c947fb3276e9d59
ADP enrichment
No English description supplied.
No references supplied.