GuardDog vulnerable to arbitrary file write when scanning a specially-crafted PyPI package

高 7.8CVE-2022-23531 · GHSA-rp2v-v467-q9vq · PYSEC-2022-42994 · 17/12/2022 公開 · 17/06/2026 更新

要点

CVE-2022-23531 は guarddog, guarddog (datadoghq) に影響する深刻度「高」 (CVSS 7.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.73%（全脆弱性の 54.4% より高い）。
対処：0.1.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
guarddog PyPI	`< 0.1.5`	`0.1.5`
guarddog datadoghq	`< 0.1.5`	`0.1.5`

概要

Impact

Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed.

This is due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. See also https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall

Remediation

Upgrade to GuardDog v0.1.5 or more recent.

References

NVD の説明

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.