CVE-2021-38197 Tarslip in go-unarr
Attackers can traverse directories via crafted TAR archives in go-unarr, potentially reading or modifying files outside the intended extraction path.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-38197?
CVE-2021-38197 is a critical path traversal vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.
Weakness: CWE-22
Which versions are affected by CVE-2021-38197?
3 open source packages ship an affected version, including github.com/gen2brain/go-unarr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gen2brain/go-unarr Go | All versions | 0.1.4 |
github.com/gen2brain/go-unarr Go | All versions | 0.1.4 |
github.com/gen2brain/go-unarr Go | All versions | 0.1.4 |
Products include Go-Unarr Project Go-Unarr.
How do I fix CVE-2021-38197?
Upgrade github.com/gen2brain/go-unarr to 0.1.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-38197 being exploited?
There is no known exploitation of CVE-2021-38197 in the wild and no public exploit code.
Sources
Also known as GHSA-v9j4-cp63-qv62, GO-2022-0929.