critical9.8
CVE-2021-38197
Tarslip in go-unarr
Impact
unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/gen2brain/go-unarr | < 0.1.4 | 0.1.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Go-Unarr Project | Go-Unarr | Version 0.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/gen2brain/go-unarr/issues/21
- https://github.com/advisories/GHSA-v9j4-cp63-qv62
- https://nvd.nist.gov/vuln/detail/CVE-2021-38197
- https://github.com/gen2brain/go-unarr/commit/239ec404d348280b50bbf671327709e8857fc5f4
- https://github.com/gen2brain/go-unarr/releases/tag/v0.1.4