id: GO-2024-2849
modules:
    - module: github.com/dotmesh-io/dotmesh
      unsupported_versions:
        - last_affected: 0.8.1
      vulnerable_at: 0.0.0-20200428140901-6bdf6885808f
summary: dotmesh arbitrary file read and/or write in github.com/dotmesh-io/dotmesh
cves:
    - CVE-2020-26312
ghsas:
    - GHSA-hf54-fq2m-p9v6
references:
    - advisory: https://github.com/advisories/GHSA-hf54-fq2m-p9v6
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2020-26312
    - advisory: https://securitylab.github.com/advisories/GHSL-2020-254-zipslip-dotmesh
    - web: https://github.com/dotmesh-io/dotmesh/blob/master/pkg/archiver/tar.go#L255
source:
    id: GHSA-hf54-fq2m-p9v6
    created: 2024-06-04T14:27:24.630281-04:00
review_status: UNREVIEWED