CVE-2024-0406

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-0406
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-0406.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-0406
Aliases
Downstream
CGA (100)
MINI (6)
openSUSE (3)
Related
openSUSE (3)
Published
2024-04-06T16:11:02Z
Modified
2026-07-17T20:58:37Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS Calculator
Summary
Mholt/archiver: path traversal vulnerability
Details

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0406.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "v3.0.0"
                },
                {
                    "fixed":  "*"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/mholt/archiver

Affected ranges

Type
GIT
Repo
https://github.com/mholt/archiver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
edeadbb1a3884e1a487283bcb73e823333fd1a10
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "3.0"
        }
    ],
    "source":  "CPE_FIELD"
}

Affected versions

v1.*
v1.0
v1.1
v1.1.1
v1.1.2
v1.2
v2.*
v2.0
v2.0.0
v2.1
v2.1.0
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-0406.json"

Git / github.com/stackrox/stackrox

Affected ranges

Type
GIT
Repo
https://github.com/stackrox/stackrox
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8b9ebeef657ee230d735661d7ebd9fd52f61833d
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:mholt:archiver:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "3.0.0"
        },
        {
            "fixed":  "4.0.0"
        }
    ],
    "source":  "CPE_FIELD"
}

Affected versions

3.*
3.65.x
3.67.x
3.68.x
3.69.x
3.70.x
3.71.x
3.72.x
3.73.x
3.74.x
4.*
4.0.0-rc.1
4.0.0-rc.2
4.0.0-rc.3
4.0.0-rc.4
4.0.0-rc.5
4.0.0-rc.6
4.0.x

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-0406.json"