| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/chainguard-dev/malcontent | < 1.21.0 | 1.21.0 |
| malcontent | < 1.21.0 | 1.21.0 |
Previously, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes.
Fix: https://github.com/chainguard-dev/malcontent/pull/1383
Acknowledgements
malcontent thanks Oleh Konko from 1seal for discovering and reporting this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free