Em resumo
- CVE-2022-23531 é uma vulnerabilidade ALTO (CVSS 7.8) que afeta guarddog, guarddog (datadoghq).
- Chance de exploração nos próximos 30 dias (EPSS): 0.73%, maior que 54.4% das vulnerabilidades.
- Correção: atualize para 0.1.5 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| guarddog PyPI | < 0.1.5
| 0.1.5
|
| guarddog | < 0.1.5
| 0.1.5
|
Description
Impact
Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed.
This is due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. See also https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall
Remediation
Upgrade to GuardDog v0.1.5 or more recent.
References
NVD description
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free