Diffoscope may write to arbitrary locations due to an untrusted archive

CRÍTICO 9.8CVE-2017-0359 · GHSA-8p5c-f328-9fvv · PYSEC-2018-83 · Published 13/04/2018 · updated 17/06/2026

En resumen

CVE-2017-0359 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a diffoscope, diffoscope (reproducible builds).
Probabilidad de explotación en los próximos 30 días (EPSS): 2.2%, mayor que el 83.0% de las vulnerabilidades.
Solución: actualizar a 76, 77 o posterior.

Package	Affected versions	Patched versions
diffoscope PyPI	`< 76< 77`	`7677`
diffoscope reproducible_builds	`< 77`	`77`

diffoscope before 76 writes to arbitrary locations on disk based on the contents of an untrusted archive.

NVD description

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.