CVE-2020-29529: GHSL-2020-262: Unsafe handling of symbolic links in go-slug unpacking routine - CVE-2020-29529
HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.
Other sources
HashiCorp go-slug up to 0.4.3 did not fully protect against Zip Slip attacks while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0
References: https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0 https://github.com/hashicorp/go-slug/pull/12 https://github.com/hashicorp/go-slug/releases/tag/v0.5.0
— Red Hat
The unsafe handling of symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations outside the designated target folder.
— GitHub Security Lab
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-29529?
CVE-2020-29529 is a vulnerability in HashiCorp go-slug up to version 0.4.3 that allows directory traversal while unpacking tar archives, which can be bypassed with specific constructions of multiple symlinks.
How severe is CVE-2020-29529?
CVE-2020-29529 has a severity rating of 7, which is considered high.
How can I fix CVE-2020-29529?
CVE-2020-29529 can be fixed by updating HashiCorp go-slug to version 0.5.0 or higher.
Where can I find more information about CVE-2020-29529?
You can find more information about CVE-2020-29529 on the following references: [Reference 1](https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0), [Reference 2](https://github.com/hashicorp/go-slug/pull/12), [Reference 3](https://github.com/hashicorp/go-slug/releases/tag/v0.5.0)
What are the Common Weakness Enumerations (CWE) associated with CVE-2020-29529?
The Common Weakness Enumerations (CWE) associated with CVE-2020-29529 are CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) and CWE-59 (Improper Link Resolution Before File Access ('Link Following')).