blob: fdc966e7b0d66ab2735bfaf8aa8376f3b8a0548b [file] [log] [blame]
id: GO-2023-2048
modules:
- module: github.com/cyphar/filepath-securejoin
versions:
- fixed: 0.2.4
vulnerable_at: 0.2.3
packages:
- package: github.com/cyphar/filepath-securejoin
goos:
- windows
symbols:
- SecureJoinVFS
derived_symbols:
- SecureJoin
summary: |-
Paths outside of the rootfs could be produced on Windows in
github.com/cyphar/filepath-securejoin
description: |-
Certain rootfs and path combinations result in generated paths that are outside
of the provided rootfs on Windows.
ghsas:
- GHSA-6xv5-86q9-7xr8
credits:
- '@pjbgf'
references:
- advisory: https://github.com/cyphar/filepath-securejoin/security/advisories/GHSA-6xv5-86q9-7xr8
- fix: https://github.com/cyphar/filepath-securejoin/commit/c121231e1276e11049547bee5ce68d5a2cfe2d9b
review_status: REVIEWED