high8.8
CVE-2024-55587
python-libarchive directory traversal
Impact
python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | python-libarchive | <= 4.2.1 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| Python-Libarchive | through 4.2.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/smartfile/python-libarchive/blob/c7677411bfc4ab5701d343bc6ebd9e35c990e80e/libarchive/zip.py#L107
- https://github.com/smartfile/python-libarchive/issues/42
- https://github.com/smartfile/python-libarchive/pull/41
- https://github.com/advisories/GHSA-75mx-hw5q-pvx3
- https://nvd.nist.gov/vuln/detail/CVE-2024-55587