Diffoscope may write to arbitrary locations due to an untrusted archive

CRITICO 9.8CVE-2017-0359 · GHSA-8p5c-f328-9fvv · PYSEC-2018-83 · Published 13/04/2018 · updated 17/06/2026

In breve

CVE-2017-0359 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda diffoscope, diffoscope (reproducible builds).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.2%, superiore al 82.9% delle vulnerabilità.
Correzione: aggiornare a 76, 77 o successiva.

Package	Affected versions	Patched versions
diffoscope PyPI	`< 76< 77`	`7677`
diffoscope reproducible_builds	`< 77`	`77`

diffoscope before 76 writes to arbitrary locations on disk based on the contents of an untrusted archive.

NVD description

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.