GHSA-p24m-wf3f-3mf5: wummel patool Gzip Extraction fileutil.py extract_gzip symlink
A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extractgzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using wummel patool 4.1.0 and invoking the Gzip Extraction Handler may be exposed. Exploitation requires local access and low-level privileges.
What impact can successful exploitation have?
The issue can cause the extraction process to follow a symbolic link. The supplied severity data indicates low impacts to integrity and availability, with no indicated confidentiality impact.
What component should be reviewed during triage?
Review uses of the extract_gzip function in patoolib/fileutil.py, specifically workflows that process gzip extraction and may encounter symbolic links.