blob: 45233ff1fde38096066a4d4231035ca582e10412 [file] [log] [blame]
{
"schema_version": "1.3.1",
"id": "GO-2022-1114",
"modified": "0001-01-01T00:00:00Z",
"published": "0001-01-01T00:00:00Z",
"aliases": [
"CVE-2022-41920",
"GHSA-pp3f-xrw5-q5j4"
],
"summary": "ZipSlip when unzipping files in github.com/duke-git/lancet",
"details": "A ZipSlip vulnerability exists when using the fileutil package to unzip files.",
"affected": [
{
"package": {
"name": "github.com/duke-git/lancet",
"ecosystem": "Go"
},
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.4"
}
]
}
],
"ecosystem_specific": {
"imports": [
{
"path": "github.com/duke-git/lancet/fileutil",
"symbols": [
"UnZip"
]
}
]
}
},
{
"package": {
"name": "github.com/duke-git/lancet/v2",
"ecosystem": "Go"
},
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.1.10"
}
]
}
],
"ecosystem_specific": {
"imports": [
{
"path": "github.com/duke-git/lancet/v2/fileutil",
"symbols": [
"UnZip"
]
}
]
}
}
],
"references": [
{
"type": "REPORT",
"url": "https://github.com/duke-git/lancet/issues/62"
},
{
"type": "FIX",
"url": "https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572"
},
{
"type": "FIX",
"url": "https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9"
}
],
"database_specific": {
"url": "https://pkg.go.dev/vuln/GO-2022-1114",
"review_status": "REVIEWED"
}
}