ac125ee29a
As proposed in #240 and tracked in #414, this PR translates all advisories into the new "V3" advisory format, which is based on Markdown with leading TOML front matter. This format makes it easier to see rendered Markdown syntax descriptions, whether rendered by an IDE or GitHub. This should help with both crafting advisories initially as well as review, and ideally encourages more lengthy descriptions. Support for this format shipped in `cargo-audit` v0.12.0 on May 6th, 2020.
1.0 KiB
[advisory]
id = "RUSTSEC-2018-0002"
package = "tar"
aliases = ["CVE-2018-20990"]
date = "2018-06-29"
keywords = ["file-overwrite"]
url = "https://github.com/alexcrichton/tar-rs/pull/156"
[versions]
patched = [">= 0.4.16"]
unaffected = []
Links in archives can overwrite any existing file
When unpacking a tarball with the unpack_in-family of functions it's intended
that only files within the specified directory are able to be written. Tarballs
with hard links or symlinks, however, can be used to overwrite any file on the
filesystem.
Tarballs can contain multiple entries for the same file. A tarball which first contains an entry for a hard link or symlink pointing to any file on the filesystem will have the link created, and then afterwards if the same file is listed in the tarball the hard link will be rewritten and any file can be rewritten on the filesystem.
This has been fixed in https://github.com/alexcrichton/tar-rs/pull/156 and is
published as tar 0.4.16. Thanks to Max Justicz for discovering this and
emailing about the issue!