GuardDog vulnerable to arbitrary file write when scanning a specially-crafted PyPI package

CAO 7.8CVE-2022-23531 · GHSA-rp2v-v467-q9vq · PYSEC-2022-42994 · Công bố 17/12/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-23531 là lỗ hổng mức CAO (CVSS 7.8) ảnh hưởng guarddog, guarddog (datadoghq).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.73%, cao hơn 54.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.1.5 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
guarddog PyPI	`< 0.1.5`	`0.1.5`
guarddog datadoghq	`< 0.1.5`	`0.1.5`

Mô tả

Impact

Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed.

This is due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. See also https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall

Remediation

Upgrade to GuardDog v0.1.5 or more recent.

References

Mô tả của NVD

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.