VDB
GHSA-6xv5-86q9-7xr8
GHSA-6xv5-86q9-7xr8
PUBLISHED
SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | flux-source-controller-0 | * |
| chainguard | argo-cd-2.8 | * |
| chainguard | ctop | 0 |
| chainguard | tomcat-8.5.87 | * |
| wolfi | kyverno | * |
| wolfi | pulumi-kubernetes-operator | * |
| wolfi | k8sgpt | * |
| chainguard | cadvisor | * |
| chainguard | kyverno | * |
| chainguard | helm-3 | *, *, * |
| chainguard | flux-kustomize-controller | *, *, * |
| wolfi | runc | * |
| chainguard | kubevela | *, *, * |
| wolfi | zot | *, *, * |
| chainguard | flux-source-controller | * |
| wolfi | helm-4 | * |
| wolfi | helm-3 | * |
| chainguard | flux-kustomize-controller-0 | * |
| wolfi | argo-cd-2.8 | * |
| chainguard | flux-image-automation-controller | * |
…and 46 more
Timeline
- Sep 7, 2023 CVE Published
References
- GitHub Advisory GHSA-6xv5-86q9-7xr8 vendor-advisory
- https://github.com/cyphar/filepath-securejoin package
- https://github.com/cyphar/filepath-securejoin/security/advisories/GHSA-6xv5-86q9-7xr8 url
- https://github.com/cyphar/filepath-securejoin/pull/9 fix
- https://github.com/cyphar/filepath-securejoin/releases/tag/v0.2.4 fix
- https://github.com/cyphar/filepath-securejoin/commit/c121231e1276e11049547bee5ce68d5a2cfe2d9b fix