p PatchFirst

CVE-2022-23531

CVE-2022-23531 · Arbitrary file write when scanning a specially-crafted local PyPI package

This page contains facts from public vulnerability sources. Check the original advisory before updating.

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.

CVSS 5.8 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • guarddog

    Versions
    • < 0.1.5: Affected

    No fix published

  • guarddog PyPI

    Versions
    • 0.1.1
    • 0.1.3
    • 0.1.4
    Affected ranges
    • ECOSYSTEM: < 0.1.5

    Update to 0.1.5

  • guarddog PyPI

    Versions
    • 0.1.1
    • 0.1.3
    • 0.1.4
    Affected ranges
    • GIT: < a56aff58264cb6b7855d71b00dc10c39a5dbd306
    • ECOSYSTEM: < 0.1.5

    Update to 0.1.5

Original sources

Check your server →